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‘The Personal Health Information Protection Act, 2004: (a) to establish rules for the 
collection, use and disclosure of personal health information about individuals that 
protect the confidentiality of that information and the privacy of individuals with respect 
to that information, while facilitating the effective provision of health care? 
(b) to provide individuals with a right of access to personal health information about 
themselves, subject to limited and specific exceptions set out in this Act; (c) to provide 
individuals with a right to require the correction or amendment of personal health 
information about themselves, subject to limited and specific exceptions set out in this 
Act; (d) to provide for independent review and resolution of complaints with respect to 


personal health information.... 
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The purposes of the Freedom of Information and Protection of Privacy Act and the Municipal Freedom of 


Information and Protection of Privacy Act are: 


a) To provide a right of access to information under the control of government 


organizations in accordance with the following principles: 


« information should be available to the public; 


* exemptions to the right of access should be limited and specific; 


* decisions on the disclosure of government information may be 


reviewed by the Information and Privacy Commissioner. 


b) To protect personal information held by government organizations and to 


provide individuals with a right of access to their own personal information. 


The purposes of the Personal Health Information Protection Act are: 


To protect the confidentiality of personal health information in the custody or 
control of health information custodians and to provide individuals with a 
right of access to their own personal health information and the right to seek 


correction of such information, with limited exceptions. 
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ROLE AND MANDATE 


Ontario’s Freedom of Information and Protection of Privacy Act, 
which came into effect on January 1, 1988, established an 
Information and Privacy Commissioner (IPC) as an officer of the 
Legislature to provide an independent review of the decisions 
and practices of government organizations concerning access and 
privacy. The Commissioner is appointed by and reports to the 
Legislative Assembly of Ontario and is independent of the 


government of the day. 


The Municipal Freedom of Information and Protection of Privacy 
Act, which came into effect January 1, 1991, broadened the 
number of public institutions covered by Ontario’s access and 
privacy legislation. 

The Personal Health Information Protection Act, 2004 (PHIPA), 
which came into force on November 1, 2004, is the third of the 
three provincial laws for which the IPC is the oversight agency. 
PHIPA governs the collection, use and disclosure of personal 


health information within the health care system. 


The Information and Privacy Commissioner plays a crucial role 
under the three Acts. Together, the Acts establish a system for 
public access to government information with limited exemp- 
tions, and for protecting personal information held by govern- 
ment organizations at the provincial or municipal level and by 
health information custodians. 

The provincial Act applies to all provincial ministries and most 
provincial agencies, boards and commissions and colleges of 
applied arts and technology. The municipal Act covers local gov- 
ernment organizations, such as municipalities; police, library, 
health and school boards; public utilities; and transit commissions. 
Freedom of information refers to public access to general records 
relating to the activities of government, ranging from adminis- 
tration and operations to legislation and policy. The underlying 
objective is open government and holding elected and appointed 


officials accountable to the people they serve. 


Privacy protection, on the other hand, refers to the safeguarding 
of personal information — that is, data about individuals held by 
government organizations and personal health information in 
the custody and control of health information custodians. The 
Acts establish rules about how government organizations and 
health information custodians may collect, use and disclose per- 
sonal data. In addition, individuals have a right of access to their 
own personal information — and are entitled to have these 


records corrected, if necessary. 


The mandate of the IPC under the Acts is to provide an inde- 
pendent review of government decisions and practices con- 
cerning access and privacy. To safeguard the rights established 


under the Acts, the IPC has seven key roles: 


* resolving appeals when government organizations refuse 
to grant access to information; 

* investigating privacy complaints related to government- 
held information; 

* ensuring that government organizations comply with 
the Acts; 

* conducting research on access and privacy issues and 
providing advice on proposed government legislation 
and programs; 

* educating the public about Ontario’s access, privacy and 
personal health information laws and access and 
privacy issues; 

* investigating complaints related to personal health 
information; 


* reviewing policies and procedures, and ensuring compli- 


ance with PHIPA. 


In accordance with the legislation, the Commissioner has dele- 
gated some of the decision-making powers to various staff. 
Thus, the Assistant Commissioner (Privacy), Assistant 
Commissioner (Access) and selected staff were given the 
authority to assist her by issuing orders, resolving appeals and 


investigating privacy complaints. 
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SoMWeSSlTONER’S MESSAGE 


2004 was a hallmark year for my office. The two most significant highlights were Premier Dalton McGuinty’s imme- 


diate endorsement of my “culture of openness” recommendation in my last annual report, and the enactment of the 


much-needed Personal Health Information Protection Act (PHIPA). 


Culture of Openness - 


In my 2003 annual report, released in June 2004, I outlined a 
Blueprint for Action for the government of Ontario, providing 
eight recommendations designed to further advance open, trans- 
parent government and the protection of individual privacy in 
Ontario. I made it clear that the completion of this ambitious 
agenda might be addressed over a period of several years, but I 
was greatly encouraged by the reaction of Premier McGuinty, 
who issued a statement the same day endorsing my lead recom- 
mendation — on the need for the government to develop a culture 


of openness. 


In the Blueprint for Action, | emphasized the importance of a 
central message being delivered to all levels of the Ontario gov- 
ernment: We urged the Premier to publish an open letter to all 
ministers and deputy ministers that was similar in style and sub- 
stance to the freedom of information (FOI) memoranda issued by 
then-U.S. President Bill Clinton and then-attorney general Janet 
Reno in 1993. 


I must say how pleased I was when Premier McGuinty fully 
implemented this key recommendation. Within hours of the 
release of my annual report, the Premier issued a memorandum 
to all ministers and deputy ministers calling upon them, “to strive 


to provide a more open and transparent government.” 


This memorandum emphasized that the significance and the 
substance of the Freedom of Information and Protection of Privacy 
Act (FIPPA), could not be overstated, and that the government 
“should ensure that information requested of it should continue 
to be made public unless there is a clear and compelling reason 


not to do so.” 


In furthering the objective toward a culture of openness, 
Management Board Chair Gerry Phillips and Attorney General 
Michael Bryant issued a follow-up memorandum emphasizing 


the importance of FOI legislation in the democratic process. 


The joint memorandum urged provincial 
ministries to go beyond the ceremonial and 
reactive access to information process and 
encouraged a proactive approach for 
disseminating information to the public. 
Additionally, the memorandum noted that 
although exemptions from disclosure will 
sometimes be 


necessary, discretionary 


exemptions should not be claimed solely on the 


Ann Cavoukian, Ph.D. 
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basis that they are technically available; 
Commissioner, Ontario 


instead, they should be claimed only where 


there is a clear and compelling reason to do so. 


I am confident that these two memoranda will prove to be sem- 
inal documents in a public policy culture shift, and will play a 


crucial role in ushering in a new era of openness. 


I would also like to commend Premier McGuinty and Ministers 
Phillips and Bryant for their foresight and commitment to the 


principles and values of open government. 


Personal Health Information Privacy Act 

The other hallmark of 2004 was the ratification of the Personal 
Health Information Protection Act (PHIPA), which came into 
effect November 1, 2004. The first new privacy Act in Ontario in 
nearly 14 years, it governs the collection, use and disclosure of 


personal health information within the health care system. 


The most relevant aspect of PHIPA is the implied consent model 
that applies to personal health information given to health care 
providers within the circle of care. This new Act strikes the right 
balance between allowing health care professionals to quickly 
pass on the information needed for patient care to another health 
professional, while otherwise strongly restricting unauthorized 
disclosure. I must stress that while PH/PA builds in extensive pri- 
vacy protection, it was crafted in such a way as to avoid inter- 


rupting the actual delivery of health care services. 
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The initial response to PHIPA was overwhelming. In the final 
months of 2004, my office received more than 2,000 calls from the 
public and professionals in the health sector with questions 
regarding the many aspects and implications of PH/PA., In addi- 
tion, we received requests for more than 50,000 copies of the spe- 
cial publications we produced about PH/PA (all of which are 


available on our website, www.ipc.on.ca). 


I met with the senior leaders of Ontario’s 22 regulatory colleges for 
health professionals, including the College of Physicians and 
Surgeons, the College of Nurses, the College of Pharmacists and 
the College of Chiropractors, and with associations such as the 
Ontario Hospital Association, the Ontario Medical Association and 
the Ontario Pharmacists’ Association. Along with senior members 
of my staff, 1 made a number of presentations across Ontario to 
health professionals and health organizations on PHIPA, including 
the Federation of Regulatory Health Professionals. 


My philosophy on working with health care custodians can be 
summarized in the “3 Cs:” co-operation, consultation, and col- 
laboration. Since the implementation of PH/PA, I have spoken 
face-to-face with numerous hospital officials, doctors, dentists, 
nurses and other health care professionals regarding the new 
health information privacy Act. I am happy to report that virtu- 
ally all of these professionals have shown great interest in 
learning about the requirements of PHIPA and in developing 


best practices for their respective areas. 


if 


High Profile Privacy Incident 


The most high profile privacy incident of 2004 occurred in 
November. The IPC was notified by the Ministry of Finance 
(ministry) and Management Board Secretariat (MBS) that there 
had been a breach of the Freedom of Information and Protection 
of Privacy Act. 


The ministry informed the IPC that the cheque stubs on more 
than 27,000 cheques mailed out by the Shared Services Bureau 
(SSB), part of MBS — to recipients under the Ontario Child Care 
Supplement for Working Families Program — included the name, 
address and Social Insurance Number of another recipient, as 
well as each recipient's own personal information. In all but 
seven cases, the personal information of a recipient was printed 
on one other cheque stub. However, one recipient's name, 


address and SIN appeared on the stubs of 220 other cheques. 
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The IPC’s investigation into this breach, with the full co-opera- 
tion of the ministry, MBS, and the SSB, determined that the inci- 
dent was triggered by the implementation of a software system 
upgrade, which caused a spacing problem in the printing of each 
cheque stub. I made a number of recommendations that the min- 


istries quickly acted upon. 


I commend the ministry and MBS for taking responsible meas- 
ures by immediately notifying my office of the situation and 
quickly notifying the cheque recipients about the privacy 
breach, as well as immediately moving to implement the rec- 


ommendations I made. 


Public Surveillance Cameras 


In 2001, the IPC published Guidelines for Using Video 
Surveillance Cameras in Public Places (the Guidelines) to provide 
a framework of privacy safeguards for government institutions 
to follow when considering video surveillance programs. Over 
the past several years, Ontario municipalities have been consid- 
ering with increasing frequency the implementation of video 
surveillance technology for crime control and public safety pur- 
poses. To achieve these objectives, street video surveillance pro- 
grams located in downtown areas have been introduced in 


several municipalities. 


We have recently become aware that local businesses are begin- 
ning to express an interest in operating comprehensive street 
video surveillance systems for security reasons. We have no 
objection to the participation of businesses in public video sur- 
veillance systems — and, in fact, we support their participation, as 
they are stakeholders in such programs. However, public areas 
and streets are the domain of all citizens and the collection of 
images of individuals who are traveling in public areas has 
important privacy implications. Further, crime control and the 
safety of public spaces are the responsibility of local government. 
Accordingly, it is our position that, if justifiable, video surveil- 
lance of public streets should only be undertaken by government 
institutions whose responsibility it is to ensure compliance with 
the Municipal Freedom of Information and Protection of Privacy Act 
and the IPC’s Guidelines. 


Looking Forward 


For 2005, I am renewing my commitment to working towards 


three important objectives. These include: 


« the introduction of a made-in-Ontario privacy law that 
would apply to the full provincially regulated private 


sector; 


- the long-awaited “substantial similarity” ruling with 


regard to PHIPA; and 
* amore open and transparent government. 


Current Ontario privacy laws cover the provincial and municipal 
public sectors and the full health sector, while the commercial 
portion of Ontario’s private sector is regulated under the federal 
Personal Information Protection and Electronic Documents Act 
(PIPEDA). There is, however, a real need for an Ontario privacy 
law that would cover the private sector. All of Canada’s other 
large provinces — Quebec, Alberta and British Columbia — have 
introduced their own private sector privacy legislation. Ontario, 
with the largest number of registered private businesses, is left 
with its commercial sector under a federal law. For efficiency, 
clarity and consistency (rather than having some sectors covered 
by a federal privacy law and others by provincial laws), and to 
extend privacy laws to non-government organizations, which 
currently do not fall under any privacy law, Ontario needs made- 
in-Ontario privacy legislation that would cover the full private 
sector. I call upon Premier McGuinty to make a commitment to 


developing a private sector privacy law in 2005. 


Now, the second objective. The federal government has issued a 
draft Order in Council exempting health information custodians 
from the operation of PIPEDA, and solicited comments on the 
draft Order. It is my belief that we will soon see a final 
Exemption Order recognizing the substantial similarity of 
PHIPA to PIPEDA, so that health information custodians cov- 
ered by PHIPA will not also be subject to PIPEDA. 


I am looking forward to the Order as my office has worked very 
hard toward this particular goal. I have written numerous letters 
to senior government officials, including the Minister of Industry 
and the Federal Privacy Commissioner, asking for their consid- 
eration in this matter, and I believe that the fruit of this labour 


will be soon in coming. 


The third objective for 2005 builds on the government commit- 
ment to enhancing a culture of openness in Ontario. I reiterate 
my support and commendation for the Premier’s memorandum 
and the subsequent joint communication from the Chair of 
Management Board and the Attorney General on this subject. 
Central to these messages was the need for government staff, in 
responding to freedom of information requests from the public, 
to claim discretionary exemptions only where there is a clear and 
compelling reason to do so. This is a powerful signal to public 
servants that release of information to the public should be the 
operational “default.” It will be my expectation during 2005 that 
access to information will not be refused simply because a discre- 
tionary exemption can be applied. Rather, in reviewing those 
cases where access has been denied through the application of 
discretion, we will be looking for clear and compelling bases for 


denial. 


Personal Thanks 


This year, my first thank-you goes to Assistant Commissioner 
Tom Mitchinson, who retired at the end of December, for his 
many, many contributions to the IPC and to Ontario. Among the 
first employees of the IPC, “Mitch,” as I fondly called him, began 
his career with us in 1988 as Executive Director and served as 
Assistant Commissioner from 1991 onwards. In so many ways, 
Mitch was an invaluable asset to this office and we wish him all 


the best in his retirement. 


I would also like to give my sincere thanks to all the staff in my 
office. The year 2004 proved to be one of the most demanding in 
recent memory, with ever mounting expectations placed upon 
this office. I consider myself very fortunate to have such a tal- 
ented and dedicated staff. Everyone at the IPC takes their 
responsibilities, and the mandate of this office, very seriously on 
behalf of the people of Ontario. I am very proud of my team and 
am grateful to have the opportunity to work with such profes- 
sional people in support of open government and the protection 


of privacy. My heartfelt thanks to you all. You’re the best! 
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In my last annual report, I set out a Blaeprint for Action for the new Ontario government on access and privacy issues. 


In particular, I made eight recommendations that were designed 
to enhance open, transparent government and the protection of 
individual privacy in Ontario. I emphasized that not all of these 
reforms needed to be made right away. During the past year, we 
have seen significant action on some of these recommendations, 
while other reforms remain on the government’s agenda but 


have not yet been implemented. 


Culture of Openness 


Our Blueprint for Action urged the Ontario government to take 
steps to establish a new culture of openness. In particular, we rec- 
ommended that Premier Dalton McGuinty issue an open letter 
to all ministers and deputy ministers that was similar in style and 
substance to the freedom of information (FOI) memoranda 
issued by then-U.S. President Bill Clinton and then-attorney 


general Janet Reno in 1993. 


The government has fully implemented this recommendation. 
Within hours of the release of my 2003 annual report on June 15, 
2004, the Premier sent a memorandum to all ministers and 
deputy ministers that urged them to “to strive to provide a more 
open and transparent government” and emphasized the impor- 
tance of the Freedom of Information and Protection of Privacy Act 
(FIPPA). 


On December 1, 2004, Management Board Chair Gerry Phillips 
and Attorney General Michael Bryant issued a follow-up memo- 
randum that emphasized the importance of FOI legislation in 
the democratic process. It urged ministries to go beyond the 
formal, reactive access to information process and to proactively 
disseminate information to the public. Equally important, it 
noted that although exemptions from disclosure will sometimes 
be necessary, discretionary exemptions should not be claimed 
solely on the basis that they are technically available; instead, they 
should be claimed only where there is a clear and compelling 


reason to do so. 
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In our view, these two memoranda are groundbreaking docu- 
ments which will play a crucial role in ushering in a new culture 
of openness. We applaud the Ontario government for swiftly 


implementing this recommendation. 


Private Sector Privacy Legislation 

The federal Personal Information Protection and Electronic 
Documents Act currently applies to the private sector in Ontario 
and all other provinces that have not enacted “substantially sim- 
ilar” legislation. In our Blueprint for Action, we urged the 
Ontario government to bring forward a made-in-Ontario pri- 
vacy law that would apply to the provincially regulated private 
sector. This has yet to happen. 


The necessity for enacting a made-in-Ontario privacy law 
remains in need of action. Although Quebec, Alberta and 
British Columbia all have their own private sector privacy leg- 
islation, provincially regulated businesses in Canada’s most 
populous province are still subject to federal privacy legislation. 
The Ontario government should model a provincial privacy bill 
after comparable private sector privacy laws that were enacted 
in Alberta and British Columbia. This would ensure that com- 
panies with operations in all three provinces face a consistent set 


of rules. 


Open Meetings 

We recommended that the Ontario government introduce a 
comprehensive “open meetings” law. In October 2004, Liberal 
MPP Caroline Di Cocco introduced Bill 123, the Transparency in 
Public Matters Act, 2004. This bill captures many of the princi- 
ples that are key to an effective and meaningful open meetings 
law. We are pleased that a number of senior cabinet ministers and 
opposition politicians have expressed support for the bill, which 
has the potential to transform Ontario into one of the leading 


jurisdictions in North America when it comes to open, trans- 


parent and accountable government. In a separate article in this 
annual report, we outline our reasons for strongly recom- 
mending that the Ontario government pass the bill into law after 
it has had the benefit of a thorough vetting by the Legislative 
Assembly of Ontario. 


Chief Privacy Officer 


We called on the Ontario government to appoint a chief privacy 
officer (CPO) for the province. The CPO would be responsible 
for acting as an internal advocate for privacy at the highest levels 
and ensuring that government programs are designed in a 
manner that protects and enhances the privacy rights of 


Ontarians. 


On December 16, 2004, Management Board Chair Gerry Phillips 
announced in the legislature that the government would consider 
the feasibility of creating the position of CPO for the province of 
Ontario. This person would recommend how the government 
could strengthen its policies and practices to ensure the protec- 
tion of personal information in all government operations. 
Minister Phillips’ announcement was in response to the IPC’s 
Special Report to the Legislative Assembly of Ontario on the 
Disclosure of Personal Information by the Shared Services Bureau, 
Management Board Secretariat, and the Ministry of Finance. We 
are pleased that the government is closely examining the feasi- 
bility of appointing a CPO and recommend that such an indi- 
vidual be appointed by the end of 2005. 


Fees 


Our Blueprint for Action noted that although we support the 
user-pay principle for accessing government-held information, 
we believe that the fee structure implemented in 1996 discour- 
ages government accountability and fetters the right of Ontarians 
to access and correct their own personal information. The 
Savings and Restructuring Act, 1996 brought in higher user fees 
for FOI requests and appeals. An individual is now charged $5 
for each access request, including a request for his or her own 
personal information. If an individual appeals an institution’s 
decision to the IPC, the fee is $10 for appeals relating to access to 
or correction of one’s own personal information and $25 for 


appeals relating to access to general records. The new fee struc- 


ture that was implemented in 1996 also eliminated the two hours 


of free search time that was previously available. 


The Ontario government has not yet taken any action to reform 
the regressive fee structure that was implemented in 1996. 
Consequently, we reiterate our Blueprint recommendation that 
the government eliminate the fees charged for personal informa- 
tion requests and appeals, and restore the two hours of free 


search time. 


Contentious Issues Management 


Our Blueprint for Action expressed concern about “contentious 
issues Management,” a politically driven process that involved 
putting potentially controversial FOI requests on a different and 
potentially slower track than standard FOI requests. We urged 
the Ontario government to reform the contentious issues man- 


agement process and put in place a policy that makes it clear that: 


- The 30-day statutory timeframe for processing FOI 
requests must take precedence over any process for man- 


aging contentious issues; and 


«+ The names of requesters shall only be disclosed on a 


“need-to-know” basis within a ministry. 


It is our understanding that the Ontario government still has a 
process in place to give ministers a “heads up” about the dis- 
closure of potentially controversial records under FOI, which, 
on its own, is not a problem. We are pleased that, over the past 
year, we have not seen any evidence to show that this process 1s 
having an adverse effect on the 30-day statutory timeframe for 
responding to FOI requests, or that the names of requesters are 
being disclosed inappropriately. Although we do not have any 
further recommendations in this area, we urge the government 
to continue to be vigilant about ensuring that politically driven 
processes do not interfere with the public’s right to access gov- 


ernment-held records. 


Employment Information of Public Servants 


In 1995, the Ontario government enacted the Labour Relations 
and Employment Statute Law Amendment Act (Bill 7), which 
contained provisions that excluded a wide range of employment- 
related records about public sector employees from the scope of 


the Freedom of Information and Protection of Privacy Act and the 


IPC Annual Report 2004 5 


Municipal Freedom of Information and Protection of Privacy Act 
(the Acts). Public sector employees are currently precluded from 
obtaining access to most employment-related records about 
themselves, and from filing a privacy complaint if they feel that 
their personal information has been improperly collected, used, 


disclosed or retained. 


In our Blueprint for Action, we recommended that the Ontario 
government restore the access and privacy rights of public sector 
workers by repealing the Bill 7 provisions of the Acts. This 
reform has not yet been implemented. We urge the government 


to take action on this recommendation in 2005. 


Public Registries 

In our Blueprint for Action, we urged the Ontario government to 
initiate a public consultation process to identity how the Acts can 
be amended to properly deal with the treatment of publicly avail- 
able personal information in an electronic world. The largest col- 
lections of publicly available personal information are known as 
public registries and include the land registry, the Personal 
Property Security Registration system, election finance records 


and the property assessments rolls. 


We warned that if the entire content of such registries is readily 
accessible in electronic format, the personal information of citi- 
zens can be easily retrieved, searched, sorted, manipulated and 
used for purposes (e.g., identity theft) that have no connection to 


the original purpose for which the information was collected. 


A 2004 Divisional Court decision has provided greater clarity to 
institutions that administer public registries. The Court quashed 
an IPC order that had directed the Municipal Property 
Assessment Corporation to disclose an electronic version of the 
province’s property assessment rolls to a collection agency. It 
noted that the database would be used by the requester for purely 
commercial purposes and stated that “there are no compelling 
public policy considerations that override the privacy interests at 


stake in the case before us.” 


The Court distinguished this case from a 2002 Divisional Court 
decision, which involved a newspaper reporter who had 
requested access to an electronic database held by the City of 
Toronto that contained personal information about election cam- 
paign contributors. In that case, the Court ordered that the data- 


base be disclosed to the requester. It emphasized the importance 
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of transparency in the democratic process and observed that 
“public accountability in the election process should, where nec- 


essary, override the privacy interests at stake...” 


Although these court decisions clarify whether and in what cir- 
cumstances public registries may be released in electronic format, 
we would note that there are a handful of jurisdictions around 
the world, such as New Zealand and the Australian state of New 
South Wales, which have put in place special statutory rules gov- 
erning public registries. Consequently, we recommend that the 
Ontario government consider whether implementing similar 
rules in Ontario could alleviate remaining concerns about public 
registries and strike a better balance between the access and pri- 


vacy interests at stake. 


BRINGING ONTARIO’S 
FREEDOM OF INFORMATION LAWS 
Poe tneeZ tol CENTURY 


When passed in 1987, Ontario’s Freedom of Information and 
Protection of Privacy Act (the Act) was among the most progres- 
sive of the day. Most jurisdictions, both in Canada and abroad, 
had not yet formally recognized the value of freedom of infor- 
mation by enacting legislation. Today, the landscape has 
changed. More than 50 countries have adopted FOI laws, and an 
additional 30 are in the process of doing so. In Canada, the gov- 
ernments of every province and territory are now subject to 


freedom of information legislation. 


Since enactment, Ontario’s provincial Act, and the subsequent 
Municipal Freedom of Information and Protection of Privacy Act, 
which came into force January 1, 1991, have enhanced govern- 
ment openness and transparency by making the vast majority 
of government records subject to public scrutiny. Through the 
two Acts, the public has been able to gain access to important 
information concerning policy proposals, contracts and 
spending priorities. 

The current provincial government was elected on a platform 
that included a commitment to enhance openness and promote 
democratic renewal. One of the ways that the government has 
chosen to act on this mandate is to formally recognize the value 
of freedom of information legislation (see the Access and Privacy 
Blueprint for Action: A Progress Report). 

While these initial developments are positive, further steps can 
be taken, including amending the Acts, to ensure that measures 
aimed at enhancing transparency and openness are enacted 
into law. This would bring Ontario’s legislation into line with 
more recently enacted freedom of information legislation 


across Canada. 


Scope of the Acts 


One of the foundations underlying freedom of information is the 
principle that organizations that exist by virtue of public funding 
“should be subject to public scrutiny through FOI laws. Ontario 
would be able to extend the application of this principle by 


extending the range of entities that are subject to the Acts. 


Recently, the Ontario government extended the application of 
the provincial Act to the publicly owned hydro utilities, Hydro 
One Inc., and Ontario Power Generation Inc., a step the IPC had 
been calling for since the main successor companies to Ontario 


Hydro were moved outside FOI by the previous government. 
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And, in its spring 2005 budget bill, the government announced 
plans to bring universities under the Act, which the IPC has been 


urging for a number of years. 


In the interests of promoting greater accountability and trans- 
parency, the government should expand the scope of coverage of 
the Acts by greatly expanding the range of organizations that are 
subject to the provisions. For example, the provincial Act applies 
only to ministries of the government of Ontario and any agency, 
board, commission, corporation or other body designated as an 
institution under the regulations. A number of organizations that 
are recipients of large transfer payments from the government 
are not subject to the Acts, and therefore, the records of these 


organizations are not subject to scrutiny by the public. 


Recently, the provincial government passed the Audit Statute 
Law Amendment Act, 2004, which extended the power of the 
Auditor General of Ontario to conduct value-for-money audits 
of institutions in the broader public sector, including audits of 
hospitals and universities. Similar amendments should be under- 


taken with respect to records under Ontario’s FOI regime. 


The FOI laws in a number of other jurisdictions in Canada are 
more inclusive. For instance, in British Columbia, that province’s 
statute applies to all organizations that are deemed to be “public 
bodies,” which includes hospitals, universities and British 
Columbia’s Child Protection Services (which is the equivalent of 
Ontario’s Children’s Aid Societies). None of these entities are 
covered under Ontario’s FOI legislation, and subjecting these 
organizations to freedom of information requests would help 


shed light on the operations of these organizations. 


Make employment records subject to the Act 


In 1995, the Ontario government of the day passed Bill 7, the 
Labour Relations and Employment Statute Law Amendment Act. 
That law included amendments to Ontario’s freedom of infor- 
mation legislation that removed a wide array of records con- 
cerning employees and labour relations from the scope of the 
Acts. By virtue of this amendment, employees of provincial and 
municipal government organizations are no longer entitled to 


submit requests for access to their own personnel files. 


In addition, because the exclusion of records applies to the pri- 
vacy, as well as the access provisions of the Acts, the personal 


employment information of employees of government organi- 
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zations is not subject to the statutory privacy protections 1n the 
legislation. 


This exclusion is particularly troubling when the employment 
information of employees of federally regulated organizations 1s 
subject to privacy legislation — the Personal Information 
Protection and Electronic Documents Act (PIPEDA). 


Under PIPEDA, employees of federally regulated organizations 
(such as banks and airlines) have a right of access to, and may 
seek correction of, their personal employment information, and 
the right to file privacy complaints related to the workplace. 
Public sector employees of the Ontario government and munic- 
ipal organizations covered under the Municipal Freedom of 
Information and Protection of Privacy Act do not possess similar 
rights. The access and privacy rights of public sector workers 


should be restored through the repeal of the Bill 7 provisions. 


Proactive disclosure 


While making records available to the public in response to 
formal access requests is an important component of a culture of 
openness, government organizations should also strive to 
enhance transparency whenever possible by routinely and proac- 
tively disclosing relevant information, even in the absence of 


formal freedom of information requests. 


From an international perspective, the connection between the 
Internet and freedom of information legislation is not new. In the 
United States, departments of the federal government are now 
required to create online “electronic reading rooms,” where the 
public is able to access information that has been the subject of 
multiple FOI requests.The government of Quebec recently 
introduced Bill 86, which would amend that province’s access to 
information legislation to require all public bodies to implement 
“information distribution policies.” These policies would estab- 
lish which documents held by government should be proactively 
disclosed, and specifically notes that certain information should 
be made systematically available through the Internet. A similar 


scheme should be adopted in Ontario. 
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Conclusion 


The IPC is pleased with the steps the provincial government has 
taken on freedom of information. However, significant enhance- 
ments to the legislation are needed to bring Ontario’s freedom of 


information laws up to the standards of the 21st century. 


Pei voAcay PROTECTION 
fore OUR MOST. SENSITIVE 
PERSONAL INFORMATION 


Personal health information — among the most sensitive of all 
personal information — finally has long-awaited statutory privacy 


protection. 


The Personal Health Information Protection Act, 2004 (PHIPA), 
the first new privacy Act in Ontario in nearly 14 years, came into 
effect Nov. 1, 2004. The IPC, which has been calling for such a 
law for years, has been designated as the oversight body respon- 


sible for its enforcement. 


PHIPA provides a set of comprehensive rules that apply across 
Ontario’s health sector, governing the collection, use and disclo- 
sure of personal health information. It is based on internationally 
recognized fair information practices, including accountability, 
consent, accuracy, limiting collection, use, and disclosure, and 


establishing security safeguards. 


The law, with very limited exceptions, provides individuals with 
the right to access their own personal health information, and to 
seek correction of it. And, anyone who feels that a health infor- 
mation custodian has inappropriately collected, used or disclosed 
his or her personal health information has the right to make a 
complaint to the IPC. Individuals can also file a complaint if 
denied access to their own personal health records, or correction 


of those records. 


Overall, PHIPA strikes the right balance between the legitimate 
need of health professionals to collect, use or disclose personal 
health information and the need to maintain the confidentiality 
of such sensitive information. It accomplishes this by giving indi- 
viduals greater control over how their personal information 1s 
handled while, at the same time, providing health information 
professionals with a flexible framework to access and use health 


information as necessary — but just within the health care system. 


PHIPA sets out specific limitations and restrictions on how per- 
sonal health information is to be managed by health information 
custodians. It applies to all types of personal health information 
in the custody and control of health care providers and other 


health information custodians. 


One of the unique features of this law is the implied consent 
model that enables health information custodians to rely on 
implied consent to collect, use and disclose personal health infor- 
mation when providing health care (such as when a patient is 
referred to a specialist or sent for x-rays). Custodians and 


researchers are also permitted to use and disclose personal health 
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information for research purposes if the approval of a research 


ethics board is obtained and other requirements are met. 


Another critical feature of PH/PA is that all health information 
custodians are required to implement policies and safeguards to 
ensure that security standards are in place. Custodians are also 
required to be open about their information practices and to pro- 
vide notices about the anticipated uses and disclosures of personal 


health information. 


Compliance 


As part of her oversight responsibilities, the legislation gives 
the Commissioner the authority to investigate, adjudicate and 
issue orders to resolve complaints filed against health informa- 


tion custodians. 


Commissioner Ann Cavoukian has appointed Ken Anderson 
as the Assistant Commissioner for health privacy to assist in 
issuing orders, resolving complaints and investigating health 


privacy breaches. 


The Commissioner is required, in consultation with the Assistant 
Commissioner for health privacy, to provide information on the 
number and nature of complaints received by the Commissioner 
under PHIPA — and the disposition of these — in an annual 
report. There were no complaints received during the first two 
months that PHJPA was in force (through December 2004). 


Copies of all 2005 orders to date and summaries of complaints 
resolved through mediation are posted on the IPC’s website, 


WWw.ipc.on.ca. 


Over the latter half of 2004, the IPC produced seven publica- 
tions devoted to PHIPA (all are available on the website) and 
continues to produce new publications related to the Act. In the 
final four months of 2004, approximately 70,000 copies of these 
publications were either distributed by the IPC or downloaded 


from its website. 


Besides the extensive publishing program, the IPC also under- 
took a number of other significant steps to help health informa- 
tion custodians and the public understand their rights and 
obligations under PH/PA. These included an extensive speaking 
program under which the Commissioner and senior staff made 
presentations across Ontario; a series of meetings where the 


Commissioner and Assistant Commissioner for health privacy 
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met with the regulatory colleges for health professionals and 
with the leaders of professional associations; and extensive par- 
ticipation in a series of information sessions on PH/PA that the 
Ministry of Health and Long-Term Care scheduled in major 
cities across Ontario. As well, the IPC set up a system to respond 
to the more than 2,000 calls and e-mails it received over the final 
four months of the year about PHIPA. And, forms for filing 
PHIPA complaints to the IPC and information on new protocols 


and other processes were developed and posted to the website. 


As well as copies of all the [PC’s PHIPA publications, the health 
privacy section of the IPC’s website (accessible from the first 
page), includes copies of many of the Commissioner’s PHIPA 
presentations, forms, flow charts showing how PHIPA com- 
plaints are dealt with, orders and mediation summaries, news 


releases related to PHIPA, links to related sites and more. 
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TRANSPARENCY IN 
pPUBUIC MATTERS 


In both the United States and Canada, the principle of open gov- 
ernment is a linchpin of democracy because it allows citizens to 
scrutinize the activities of elected officials and public servants to 


ensure that they are acting in the public interest. 


One pillar that supports open government is freedom of infor- 
mation legislation, which gives people the right to access govern- 
ment-held information. A second pillar is open meetings 
legislation, which ensures that public bodies conduct their meet- 


ings in public, except in limited and specific circumstances. 


In the U.S., the federal government and all state governments 
have enacted open meetings laws that guarantee, with limited 
exceptions, that the public can attend meetings of public bodies. 
These laws provide citizens with the right to complain about 
open meetings violations by public bodies, and provide for reme- 
dies and penalties if a court or other oversight body determines 


that a violation has occurred. 


In Ontario, the first pillar of open government has solid founda- 
tions. The Freedom of Information and Protection of Privacy Act 
and the Municipal Freedom of Information and Protection of 
Privacy Act empower citizens to access records held by govern- 
ment, and the affected institutions have demonstrated their will- 


ingness to meet the requirements of the legislation. 


But the second pillar that supports open government — requiring 


public bodies to conduct open meetings — is only partly built. 


There is no comprehensive open meetings law in Ontario. 
Instead, rules governing meeting rules tend to be subsumed in 
various pieces of legislation governing a limited group of public 
bodies, such as municipal councils, police services boards and 


school boards. 


That may be about to change. Liberal MPP Caroline Di Cocco 
has introduced a promising private member’s bill that captures 
many of the principles that are key to an effective and mean- 


ingful open meetings law. 


Bill 123, Transparency in Public Matters Act, 2004, was intro- 
duced in the Ontario legislature in October 2004 and has been 
referred to a standing committee of the legislature for further 
review. Although private member’s bills are rarely enacted into 
law, Bill 123 appears to be headed in a different direction. The 
bill appears to have attracted support from senior government 


members as well as members in the opposition ranks. 
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Bill 123 would apply to designated public bodies and types of des- 
ignated public bodies that are listed in the schedule to the bill, 
including the governing boards of hospitals, universities and col- 
leges; municipal councils; police services boards; school boards 
and library boards. It would require designated public bodies to 
ensure that meetings are open to the public but allow meetings to 


be closed in limited and specific circumstances. 


A designated public body would be required to provide the 
public with reasonable notice of its meetings, including a clear, 
comprehensive agenda of items that would be discussed. It would 
also be required to make minutes of its meetings available to the 
public at the same time as minutes are made available to the 


members of the designated public body. 


From an open government perspective, the most attractive part 
of Bill 123 is that it includes enforcement mechanisms. The bill 
would provide members of the public with a legal right to com- 
plain if they believed that open meetings rules had not been fol- 
lowed. It would also establish an oversight body responsible for 
investigating complaints and resolving disputes. A person who 
believed a designated public body had contravened or was about 
to contravene the bill could make a complaint to the Information 


and Privacy Commissioner of Ontario. 


The Commissioner would be empowered to review the com- 
plaint and to undertake a review on her own initiative. The 
Commissioner could also exercise various powers when 
reviewing a suspected contravention, including the power to 
enter and inspect premises, to demand production of things rele- 
vant to the review and to require any person to appear before the 


Commissioner to give evidence. 


With respect to remedies, the Commissioner would have the 
authority to make certain orders after an investigation, including 
an order that voids a decision made by a designated public body 
at a meeting that did not conform to the requirements of the bill. 
Such an order would be based on a procedural violation of open 
meetings rules, not on the substance of the meeting itself. The 
public body would retain the authority to start over and make the 


same decision again, but this time in compliance with the law. 


Bill 123 would also create certain offences that could lead to the 
imposition of a monetary penalty. It would be an offence to wil- 
fully obstruct or attempt to mislead the Commissioner when she 


is performing functions authorized under the bill, or to wilfully 
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fail to comply with an order of the Commissioner. A person who 
was guilty of such an offence would be liable, on conviction, to a 


fine of not more than $2,500. 


Amendments 


Although Bill 123 is an excellent open meetings bill with clear 
rules and enforcement mechanisms, it can be improved in at least 
two ways. First, the list of designated public bodies and types of 
designated public bodies that are included in the schedule to the 
bill is narrow. The intent of the legislation could be better 
achieved if the scope of the bill were expanded to include other 
public bodies that each meet as a group for deliberation and deci- 
sion-making, except for adjudicative bodies, such as the courts 
and administrative tribunals. These other bodies, not listed in the 
schedule to the bill, include organizations that deliberate and 
make decisions affecting citizens on a host of different issues, 
including the environment, the arts, economic development and 
transportation. The governing boards of these public bodies 


should be subject to all of the open meetings rules in Bill 123. 


Second, the bill does not contain a rule that would prevent public 
bodies from slipping last-minute items onto an agenda without 
notifying the public. Hawaii’s Sunshine Law stipulates that after 
an agenda has been filed, a board may not add an item if it is of 
“reasonably major importance” and action on this item by the 
board would affect a significant number of persons. Bill 123 
should be amended to include a similar rule that would prohibit 
a public body, with limited exceptions, from considering business 


not included on a published agenda. 


Bill 123 has the potential to enhance Ontario’s position as one 
of the leading jurisdictions in North America when it comes to 
open, transparent and accountable government, and we 


endorse its passage. 
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RFIDS: HOMING IN ON PRIVACY 


The introduction of RFIDs (radio frequency identifiers) on con- 
sumer products can potentially — without careful consideration of 


privacy implications — become a serious privacy threat. 


“Radio frequency identifier” is a generic term for a variety of 
technologies that use radio waves to identify individual items. 
All RFID systems have two integral parts: a tag — a tiny com- 
puter chip with an antenna — and a reader. Readers generate 
radio frequencies that activate the chip, which in turn releases 
any information it holds to the reader. That information is then 
fed into a database that can be analyzed and networked or 


linked to other databases. 


When such a system is used to track cases of cement bags through 
a supply chain — from a manufacturer, to the truck delivering the 
cement, to the construction site — there is little in the way of pri- 
vacy concerns. Even when you pay for your gas with the wave of 
a card with an embedded RFID tag over a patch on the gas 


pump, privacy concerns remain remote. 


Industry experts have said that proliferation of item-level RFID 


tags (on consumer goods) is at least five years away. 


But they are already being used in ways that most people would 
not have foreseen even a few years ago. Test deployments and 


planned uses include: 


e electronic article surveillance (in-store tracking of shop- 


ping carts and items; luggage entrusted to airlines); 


- pharmaceutical tagging to reduce counterfeiting and 


fraud; 


* convenience services (from RFID-enabled ski passes to 


vehicle access and gas payment tokens); 
* consumer safety (tagging tires to expedite recalls). 


When RFID technology finds its way into consumer goods, pri- 
vacy concerns can quickly escalate. A tag on a consumer product 
could be linked to the purchaser at the time of sale if a credit card 
or loyalty card were used, and if the identifying information 


from the card registration were linked to the tag. 


Such data linkage could establish that Sam Shopper, who bought 
a tag-bearing sweater using a loyalty card and later used the same 
card at the hardware store to pick up some tag-bearing supplies, 
has a demographic profile and individual characteristics that 
could be misused if the information came into the wrong hands. 


Even when used as intended, the information could reveal not 
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just which products a consumer purchases, and how often those 
products are used, but even where a particular product — and by 
extension the consumer — travels, unknowingly encountering 
RFID readers along the way every time he wears that sweater. 
RFID-using organizations could sell or trade this information 


with others, often unbeknownst to Sam Shopper. 


This marriage of chips to individuals concerns many, whether it 
is done through a loyalty or ID card or even imbedded under the 
skin, as in the case of selected senior staff working for Mexico’s 
Attorney General and nightclub patrons at a Spanish establish- 
ment. In the consumer space, one of the most troubling future 
scenarios involves the use of RFIDs without consumer knowl- 
edge. The tags could each have a globally unique identifier and 
the information captured by readers could be fed into databases 


linked with other databases through personal identifiers. 


It is essential that fair information practices commonly associated 
with privacy and data protection be applied in the development 
of consumer-based RFIDs, their related infrastructure, applica- 


tions and networks, including: 


Openness 


‘Consumers should always be advised if there is an RFID tag on 


a product they purchase or are given, and its location on the 


product. They should be provided with: 


- clear statements of purpose for the collection or linkage 


of personal information; 


« assurances that the collection of personal information is 


limited to that required for the expressed purpose; 


- ahigh level of accountability when it comes to an organt- 
zation’s management of personal information, including 


a simple complaint procedure. 


Informed Choice, Access and Transparency 


Controls must also be developed that would leave the consumer 


making the decision about: 
- whether the chip is left on or turned off at point of sale; 
~ whether a chip is removed or remains on a purchased item; 


» what information is presented to a reader, and under 


what conditions, if any, the chip remains active post-sale; 
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- what personal information, if any, is matched with the 
purchased product or service through data linkage, when 


and why. 


Embedded Privacy Controls 
Various types of technical controls that a chip can accommodate 


must be explored, including: 
* password controls; 


« the ability to physically disable and enable chips, or to 


block the transmission of data from it; 


¢ mandatory default deactivation for certain categories of 


products; 


« the creation of different frequencies for pre- and post- 


sale; and 


« the introduction of certain levels of security on the chip 


itself. 


Consumers have already indicated discomfort with the tracking 
of their movements through this technology, thanks to some 
early attempts to introduce it without privacy controls in place. 
Now is the time for business to ensure that privacy protections 
are built in at the design stage of any RFID systems to be used in 


the consumer Space. 
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PRIVACY NOTICES: MUST BE CLEAR 
meow Neioe TO OBE EFFECTIVE 


Do you read online privacy policies or brochures that you receive 
in the mail from your bank or insurance company? If you’re a 
lawyer or policy analyst, you may relish the opportunity to scru- 
tinize such notices, which often contain legal jargon and 
numerous clauses and sub-clauses. However, an increasing body 
of evidence shows that most individuals are turned off by such 
notices, and this can lead to an erosion of consumer trust in a 


company’s business practices. 


There is a movement afoot both globally and within Canada to 
take a “layered” approach to privacy notices, with an emphasis on 
developing “short notices.” The first layer would be a user- 
friendly short notice written in plain language, which would be 
made available to individuals at their first point of contact with 
an organization. This concise and simple notice would help indi- 
viduals to clearly understand what an organization does with 
their personal information. An organization would also give 
individuals the choice to access additional layers of information, 
which could include a longer, more detailed privacy statement or 


a brochure. 


The growing movement to establish a global short privacy notice 
had its official birth at the 2003 International Conference of Data 
Protection and Privacy Commissioners in Sydney, Australia. At 
that conference, the Commissioners passed a resolution that 
endorsed the development and use of a condensed privacy notice 
that would be standardized across the globe. The resolution 
noted the importance of enabling individuals “to be well 
informed and able to exercise choices when the organizations 


with which they are dealing operate globally.” 


Since the Sydney conference, a working group of Commissioners 
(including this office), business leaders, lawyers and privacy prac- 
titioners have been hammering out solutions for developing and 
implementing a global privacy notice. The group met in March 
2004 and prepared a memorandum that emphasized that effective 
privacy notices should be multi-layered, with all layers using plain 
language. In addition, a short notice should contain no more 
information than individuals can reasonably process. Studies on 
readability have shown that a maximum of seven categories 


should be used, with limited information in each category. 


Research on privacy policies conducted in the U.S. has provided 
persuasive evidence that a layered approach, with an emphasis on 


simple and clear short notices, is the most effective way of 
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building consumer trust. For example, the Hunton & Williams 
Center for Information Policy Leadership, which has done pio- 
neering work on short notices, has conducted focus group tests 
on privacy policies. It found that consumer trust in companies is 
eroded by long, legalistic privacy policies. Focus group partici- 
pants preferred short privacy notices that clearly communicated 
how a company was using and sharing their personal informa- 
tion, and expressed support for a common “template” that could 


be used by different companies. 


In Ontario, the IPC has taken a leadership role in promoting the 
use of short notices in the health sector. The Personal Health 
Information Protection Act (PHIPA), which came into effect 
November 1, 2004, sets out rules for the collection, use and dis- 
closure of personal health information. These rules apply to all 
health information custodians operating within the province of 
Ontario and to individuals and organizations that receive per- 
sonal health information from health information custodians. 
PHIPA requires custodians to take reasonable steps to inform the 
public about their information practices and how individuals 


may exercise their rights. 


The IPC is the oversight body for PHIPA, and Commissioner 
Ann Cavoukian has made it clear that the notices prepared by 
health professionals must serve as effective communication 
tools — they must provide useful and understandable informa- 


tion to patients. 


Consequently, a short notices working group was established in 
the fall of 2004 in order to develop notices under PHIPA. This is a 
joint project of the IPC and the Ontario Bar Association, with rep- 
resentatives from the IPC, the Ontario Bar Association’s Privacy 
Law and Health Law sections, the Ministry of Health and Long- 
Term Care, Management Board Secretariat, and the Ontario 
Dental Association. This project is very much part of the interna- 
tional effort to develop and promote the use of short notices and, 
to the best of our knowledge, is one of only two projects around the 


world focusing on short notices in the health sector. 


In line with the 2004 memorandum, the PHIPA short notices 
working group has adopted a “layered” approach, with an 
emphasis on developing separate short notices for each of the fol- 
lowing health care groups: primary care providers, hospitals and 
facilities, and long-term care facilities. These simple templates 


will have a consistent layout and format and contain necessary 
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but understandable information about the collection, use and dis- 


closure of personal health information. 


The group is also developing additional layers of information to 
supplement the information in the short notices, which will 
include easy-to-read brochures and other publications. The goal 
is to develop easily readable material containing the necessary 
elements, but not so much information that patients and others 
will give up or be unable to read them. The language of the 
notices must be understandable by all. Simplicity is the key. 
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FREEDOM OF INFORMATION 
mo BONO PROJECT 


The IPC, as the independent oversight agency responsible for 
resolving access appeals under Ontario’s Freedom of Information 
and Protection of Privacy Act and the Municipal Freedom of 
Information and Protection of Privacy Act (the Acts), has jurisdic- 
tion to hear an appeal if the record or records involved are cov- 


ered by the Acts, and to issue an order resolving the appeal. 


In the vast majority of cases, an appeal ends when the IPC has suc- 
cessfully mediated a resolution or has issued an order. IPC deci- 
sions are not subject to appeal on the basis that a party disagrees 
with the outcome. IPC decisions in access appeals can only be chal- 
lenged on limited grounds using a special type of court proceeding 
called “judicial review.” There are three basic grounds for judicial 
review: (1) the IPC had no “jurisdiction” to decide the matter; (2) 
the IPC's process was not “fair;” or (3) the IPC’s decision was 
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unreasonable” or “irrational. 


In November 2004, Pro Bono Law Ontario (PBLO) launched a 
pilot project aimed at helping eligible unrepresented individuals 


with judicial review applications arising under the two Acts. 


The project had its genesis within the IPC’s Tribunal Services 
Department. Over the years, it had become evident to the depart- 
ment that individual requesters often lack legal representation and 
are therefore unable to fully participate in court proceedings arising 
out of IPC decisions. Comments from lawyers outside the IPC sug- 
gested that there might be some interest amongst the legal profes- 


sion in providing services to needy litigants in this area of the law. 


The IPC was aware that PBLO (funded through The Trillium 
Foundation, Canadian Heritage, Legal Aid Ontario, The Law 
Foundation and the Law Society of Upper Canada) was active in 
organizing groups, law firms and law associations to address the 
legal needs of low-income and disadvantaged individuals. The IPC 
approached the PBLO to determine whether it would be interested 
in spearheading a pro bono program in the area of freedom of 
information law, and we were delighted when PBLO’s executive 


director immediately expressed enthusiasm for the idea. 


The IPC’s Tribunal Services Department worked with PBLO to 
establish the principles of such a pro bono program. Amongst 
other things, it was decided that a workable program would focus 
on court proceedings that arise out of IPC decisions. 
Representatives of Tribunal Services met with PBLO representa- 
tives, the Ministry of the Attorney General and a participating 


law firm to review the basic principles. The IPC also assisted in 
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recruiting a retired member of the legal profession who was 


willing to act as a volunteer co-ordinator for the program. 


PBLO obtained the commitment of three law firms willing to 
provide pro bono legal services through this program. The FOI 
Pro Bono Program turned out to be an appealing one for private 
sector firms. The legal profession has turned its attention in 
recent years to the challenge of meeting the needs of disadvan- 
taged groups and individuals, though the provision of pro bono 
legal services. Participation in the FOI Pro Bono Program pro- 
vides a means for some law firms to help in achieving greater 
access to justice, through interesting, appellate-level work, com- 
bining elements of public policy and established legal analysis. 
The result was an encouraging level of interest amongst private 


sector firms in donating their time to this program. 


The participating law firms identified their associates who 
would provide the legal services, and designated pro bono part- 
ners to accept and place referrals and supervise the program 
within their firms. Following this, the IPC participated (along 
with representatives of the Ministry of the Attorney General and 
the private bar) in an educational session introducing the partic- 
ipating lawyers to the program, and providing training on the 
essentials of freedom of information law. A major focus of the 
educational session was the judicial review of IPC decisions and, 
in particular, distinctive procedural and substantive aspects of 


these judicial review proceedings. 


The program was launched as a one-year pilot project, with the 
participation of the three law firms. PBLO has produced a 
brochure for distribution by the IPC on a case-by-case basis 
(modeled after current practice under The Advocates’ Society 
Court of Appeal Program). As indicated, the basic aim of the 
program is to provide legal representation to needy individuals 
who are affected by judicial review applications from an order 
of the IPC. In order to qualify for the program, individuals 
must demonstrate financial eligibility, and that their case has 
some reasonable prospect of success. The program is not 
intended to provide free legal services to replace those already 
engaged by a litigant. 

It is anticipated that the program will contribute to the general 
goal of increasing access to justice, with the additional benefit of 
providing for a fuller airing of issues of FOI law before the courts, 


through more effective participation by all interested parties. 
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One of the preceding sections, Access and Privacy Blueprint for 


Action: A Progress Report, includes a review of what the govern- 


ment has done in response to the recommendations I made in last 


year’s annual report, as well as a series of recommendations I am 


making based on government action to date. 


Here, I address the need for three over-arching steps the govern- 


ment should take that would significantly enhance freedom of 


information and protection of privacy in Ontario: 


Each year, my office has to tell Ontarians, again and 
again: “We’re sorry, but the situation you describe doesn’t 
fall under Ontario privacy legislation.” Residents of sev- 
eral other Canadian provinces have more effective pri- 
vacy protection than Ontarians. Ontario needs a 
made-in-Ontario privacy law that will cover all of the 
private sector and non-government sectors, similar to 
laws in several other Canadian provinces. The Ontario 
government should model a provincial privacy bill after 


the comparable private sector privacy laws enacted in 
Alberta and British Columbia. 


Institutions that are primarily funded by government 
dollars should be covered by Freedom of Information and 
Protection of Privacy legislation for the purposes of 
transparency and accountability. Universities, hospitals 
and Children's Aid Societies are leading examples of 
the types of institutions that need to be brought under 
this legislation. I recommend that the government 
launch an immediate review to compile a list of institu- 
tions that are primarily funded by government but are 
not yet covered by the Acts. Part two of this project 
should be a short review of which of these institutions 
will be placed under the Acts — with the default position 
being that each institution on the list will be added, 
unless there are very unique and compelling reasons 


not to add a specific institution. 


RECOMME 
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In my Special Report to the Legislative Assembly of 
Ontario on the Disclosure of Personal Information by the 
Shared Services Bureau, Management Board Secretariat, 
and the Ministry of Finance, which I tabled on December 
16, I cited the need for trial runs and testing by the 
Shared Services Bureau (SSB). While the SSB is now 
doing this, we have had another privacy breach at 
another ministry where testing was inadequate. In this 
case, problems arose with the use of new online forms 
when they were not properly tested before being posted 
live. I recommend that the government move quickly to 
advise all ministries and agencies that independent 
testing must be done on all new systems prior to their 


implementation. 
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Provincial and municipal government organizations are required under the Acts to submit a report to the IPC on the 


number of requests for information or correction to personal information they received in the prior calendar year, as well 


a 


In 2004 — for the third straight year — the number of freedom of 
information requests filed across Ontario set a record. There 
were 33,557 requests filed with provincial and municipal gov- 
ernment organizations, an 11.4 per cent increase from 2003, 
when 30,110 were received. This is the sixth straight year that the 


number of requests has increased. 


Provincial organizations received 13.5 per cent more requests in 
2004 (16,763, up from 14,774 in 2003). Of these, 5,801 (34.6 per 
cent) were for personal information and 10,962 (65.4 per cent) 


were for general records. 


Municipal government organizations received 9.5 per cent more 
requests in 2004 (16,794, compared to 15,336 in 2003). Of these, 
6,537 (38.9 per cent) were personal information requests and 


10,257 (61.1 per cent) were for general records. 


The Ministry of Health and Long-Term Care received the 
largest number of requests under the provincial Act (5,199), fol- 
lowed by the ministries of Environment (4,817), Community 
Safety and Correctional Services (2,823), and Labour (1,021). 
Together, these four ministries received 82.7 per cent of all 
provincial requests. 

Once again, Police Services Boards received the most requests 
under the municipal Act — 54.6 per cent of all requests. Municipal 
corporations were next with 41.7 per cent, followed by health 


boards at 1.7 per cent and school boards with 1.1 per cent. 


Provincial organizations responded to 68.7 per cent of requests 
within 30 days in 2004, a decline of 8.5 per cent. (The 2004 per- 
centage for provincial organizations where a minister is the head 
was 67.4.) Overall, 88.6 per cent of provincial requests were 
answered within 60 days (a decline of three per cent from 2003). 
Requests that took more than 120 days to complete increased to 


3.1 per cent from three per cent in 2003. 


Municipal government organizations responded to 75.7 per cent 
of requests within 30 days. Overall, 86.4 per cent of municipal 


requests were responded to within 60 days. Requests that 
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1s such other pertinent information as timeliness of responses, outcomes and fees collected. 


Requests Received and Completed — 2004 
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Recewed Completed  Recewed Completed 


Recewed Completed 


General Records Personal Correction Requests 


Requests Information Requests 


required more than 120 days to complete increased to 6.9 per cent 


in 2004 from six per cent in 2003. 


(For a more detailed discussion of compliance rates, see the 
chapter entitled Response Rate Compliance, which follows this 
chapter.) 


The majority of provincial requests in 2004 (80.9 per cent) were 
made by businesses, while the majority of municipal requests 


(62.8 per cent) came from individuals. 


The Acts contain a number of exemptions that allow, and in some 
situations actually require, government organizations to refuse to 
disclose requested information. In 2004, the most frequently 
cited exemption for personal information requests was the pro- 
tection of other individuals’ privacy (sections 49/38, in the provin- 
cial/municipal Acts). Privacy protection (sections 21/14) was also 
the most used exemption for general records requests. 

The Acts give individuals the right to request correction of their 


personal information held by government organizations. In 2004, 


provincial organizations received five requests for corrections 


and refused one. Municipal organizations received 67 correction 
requests and refused six. When a correction is refused, the 
requester can attach a statement of disagreement to the record, 
outlining why the information is believed to be incorrect. In 2004, 
there were five statements of disagreement filed with municipal 


organizations; one with a provincial organization. 


The legislation contains a number of fee provisions. In addition 
to application fees, which are mandatory, government organiza- 
tions can charge certain other prescribed fees for responding to 
requests. Where the anticipated charge is more than $25, a fee 
estimate can be given to a requester before search activity begins. 
Organizations have discretion to waive fees where it seems fair 
and equitable to do so after weighing several specific factors 
listed in the Aczs. 


Provincial organizations reported collecting $81,728.50 in appli- 
cation fees and $391,808.10 in additional fees in 2004. The corre- 
sponding numbers for municipal organizations were $81,459.45 


and $149,169.02. 


Search fees were the most commonly charged category by 
provincial organizations (46.5 per cent), followed by reproduc- 
tion costs (24.6 per cent) and shipping charges (18.1 per cent). 
Municipal organizations, in contrast, most frequently charged 
for reproduction costs (40.1 per cent), followed by search fees 


(28.2 per cent) and preparation costs (19.8 per cent). 


(Percentage may not equal 100 due to rounding.) 


Outcome of Provincial Requests — 2004 (%) 


60 


LIES CORT 


ERGY SRR: SURES 


; | | 
All Disclosed Disclosed in Part Nothing Disclosed Abandoned 


2000 @ 2001 @ 


2002 @ 2003 2004 


Outcome of Municipal Requests — 2004 (%) 


E 


| SSSSEAES IRENE (BAAS ERASING (ORT 


{oR PSS SSS EES EE 


: | | 
All Disclosed Disclosed in Part Nothing Disclosed Abandoned 


2000 @ 2001 @ 


2002 @ 2003 2004 


IPC Annual Report 2004 


21 


Municipal Exemptions Used 
Personal Information - 2004 


Section 38 Personal Information — 3125 (47.7%) 
Section 8 Law Enforcement — 2105 (32.1%) 


Section 14 Personal Privacy — 865 (13.2%) 


Other — 462 (7.0%) 


Provincial Exemptions Used 
Personal Information - 2004 


Section 49 Personal Information — 2797 (53.2%) 
Section 14 Law Enforcement — 1911 (36.3%) 
Section 19 Solicitor-Client Privilege — 223 (4.2%) 


Other — 330 (6.3%) 


Cases in Which Fees Were Estimated — 2004 


Collected in Full 
Waived in Part 
Waived in Full 


Total Application Fees Collected (dollars) 
Total Additional Fees Collected (dollars) 
Total Fees Waived (dollars) 


Average Cost of 
Provincial Requests 


for 2004 


Personal I 


General Records 
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Municipal Exemptions Used 
General Records - 2004 


Section 14 Personal Privacy — 3497 (57.5%) 
Section 8 Law Enforcement — 1595 (26.2%) 
Section 10 Third Party — 207 (3.4%) 


Other — 782 (12.9%) 


Provincial Exemptions Used 
General Records - 2004 


Section 21 Personal Privacy — 2172 (48.2%) 
Section 14 Law Enforcement — 1194 (26.5%) 
Section 17 Third Party — 289 (6.4%) 


Other — 848 (18.8%) 


Provincial Municipal 
398% 2168 
2.73% 149 
57.4% 3126 
$81,459.45 | 
$149,169.02 
$9,024.47 


Average Cost of 
Municipal Requests 

for 2004 

Personal Information $8.65. 


General Records pe $17.9. 


Peer ONSE RATE COMPLIANCE 


To help focus attention on the importance of complying with the response requirements of the Acts, the IPC reports 


compliance rates for each ministry and selected other government organizations. 


In keeping with a practice introduced in the 2002 annual report, 
the IPC is reporting individual compliance rates via two sets of 
charts. First, as we have done for five years, the compliance rate 
for each institution is set out in terms of meeting the 30-day 
response standard set by the Acts. A second chart reports on the 
compliance rate when Notices of Extension (section 27(1) of the 
provincial Act; section 20(1) of the municipal Acr) and Notices to 
Affected Person (section 28(1) and section 21(1) respectively) are 
included in the compliance calculations. The legitimate issuance 
of either Notice means that a government organization can be in 
compliance with the Act, despite the fact that it takes more than 


30 days to respond to a request. 


Provincial Organizations 


It is encouraging to note that 2004 saw an unprecedented number 
of provincial ministries — 19 — with compliance rates exceeding 


85 per cent (including Notices). 


In fact, 15 ministries achieved more than 90 per cent compliance, 


when Notices are factored in. 


Overall, however, provincial ministries had a compliance rate of 
68.7 per cent, a decrease from 77.2 per cent in 2003 — the first time 
in six years that the provincial compliance rate has not increased. 
When the issuance of Notices is considered, the compliance rate 
climbs to 72.3 per cent, still down eight per cent from the com- 
parable number the previous year. The decline in overall compli- 
ance is attributable to the Ministry of Health and Long-Term 
Care. If this ministry’s compliance rate (40.6 per cent) 1s removed 
from the calculation, the overall provincial compliance rate 


improves dramatically to 88.9 per cent. 


Of those ministries dealing with a large volume of requests, the 
IPC notes the achievements of the ministries of Labour and 
Natural Resources in attaining compliance rates of more than 85 
per cent, including Notices. The ministries of the Attorney 
General, Community and Social Services, Community Safety 


and Correctional Services, Consumer and Business Services, 


Finance and Transportation met compliance timeframes more 
than 90 per cent of the time, when the issuance of Notices is con- 
sidered. This is a remarkable achievement and these ministries 


are to be commended. 


The IPC is particularly pleased to see that the long-term efforts 
to improve compliance by the ministries of Natural Resources 
and Community Safety and Correctional Services have yielded 
excellent results, with Community Safety and Correctional 
Services achieving an outstanding compliance rate of 97.6 per 
cent, when the issuance of Notices is considered. The IPC also 
acknowledges the continued improvement in the Ministry of the 
Environment’s compliance rate —81.6 per cent in 2004, up five per 


cent from 2003. 


However, the IPC notes with concern the Ministry of Health and 
Long-Term Care’s 2004 compliance rate of 40.6 per cent, down 
from 75.0 per cent in 2003. The ministry explained that in 2004, 
it experienced a dramatic increase in the volume of requests. The 
ministry put in place improvement strategies to address the 
unprecedented request volume, which helped to improve com- 
pliance rates in the latter months of the year. The IPC will 
actively monitor the situation to determine if these strategies are 


a long-term solution. 


= 
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Provincial: Number of Requests Completed in 2004 (includes only Boards, Agencies and Commissions where the Minister is the Head) 


Ministry Requests Requests Within 1-30 days Within 31-60 days Within 61-90 days. More than 90 days 
Received Completed No. of Requests % No. of Requests % No.of Requests % No. of Requests % 
Agriculture & Food 32 34 30 862 3 8.8 1 3.0 02200 
Attorney General/ONAS/DRS 374 350 305 87.1 22 6.3 13 a7 05 25 
Cabinet Office 33 28 25 89.3 2 7.1 0 0.0 I 3.6 
Children & Youth Services 34 33 25 75.8 S 15.2 2 6.0 1 3.0 
Citizenship & Immigration/OSS/OWD 8 : 1 20.0 3 60.0 I 20.0 p08 
Community Safety & Correctional Services 2823 2770 2285 82.5 375 13.5 66 24 44 1.6 
Community & Social Services 355 342 283 $27 46 13.5 10 2.9 3 0.9 
Consumer & Business Services 270 267 265 99.3 2 0.7 0 0.0 0 2 08 
Culture 12 13 5 385 7 53.8 l 77 0 66 
Economic Development & Trade 17 14 12 85.8 1 Al | 7A 0. 00 
Education 34 34 29 85.3 4 11.8 0 0.0 1 2.9 
Energy 21 25 16 ~—- 64.0 5 20.0 | 4.0 3 Fee 
Environment 4814 4936 4026 —81.6 37] 75 193 3.9 346 7.0 
Finance 166 143 124 86.7 17 11.9 | 0.7 1 0.7 
Francophone Affairs 4 4 3 75.0 1 25.0 0 0.0 G00 
Health and Long-Term Care 5195 6047 2456 —- 40.6 2379 39.3 796 13.2 416 6.9 
Intergovernmental Affairs 2 2 2. 1006 0 0.0 0 0.0 268 
Labour 900 897 798 89.0 62 6.9 2 2.4 15 17 
Management Board Secretariat 18 12 ial 91.7 I 8.3 0 0.0 0 0.0 
Municipal Affairs 45 42 34 81.0 8 19.0 0 0.0 0 00 
Natural Resources 120 121 1 578 36 29.7 10 8.3 A 
Northern Development and Mines 4 5 4 80.0 0 0.0 1 20.0 0 00 
Public Infrastructure Renewal 8 6 4 66.7 2 33.3 0 0.0 6 66 
Tourism and Recreation 12 7 5 71.4 0 0.0 2 28.6 0 60 
Training, Colleges and Universities 49 53 37. 698 7 13.2 6 11.3 3 57 
Transportation 243 222 216 973 6 Ly 0 0.0 0 100.0 
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Municipal Organizations 

Overall, municipal government organizations responded to 77.6 
per cent of requests within the required timeframe. This 1s a very 
encouraging three per cent increase from 2003 and reverses the 
four-year downward trend in municipal compliance reported 
last year. One institution, Toronto Police Services, had a signifi- 
cant negative impact in the compliance rate. If its number 1s 
removed, the overall compliance rate for municipal institutions 


reaches 85.1 per cent. 


MUNICIPALITIES 


In the accompanying charts, the individual response rates from 
the municipalities that received the most requests (in each of 
three population categories) are cited. Also cited are the police 


services and health boards that received the most requests. 


Overall, municipal corporations had a 30-day compliance rate of 
79.7 per cent, a significant improvement from 66.1 per cent in 
2003. The City of Hamilton continues to improve its compliance 
rate, which has reached an outstanding 94.5 per cent, up from 
92.8 per cent last year. The cities of Mississauga and Ottawa as 
well as the Regional Municipality of York continued to achieve 


high levels of compliance. 


The City of Toronto’s 30-day response rate is 65.1 per cent, up 
from 58.7 per cent in 2003. Including Notices, Toronto’s 2004 
response rate is 66.2 per cent. During the year, the City of 
Toronto undertook a number of initiatives aimed at improving 
compliance. In a memorandum issued in August 2004, Mayor 
David Miller identified the effective administration of the 
municipal Act as part of a commitment to transparency, account- 
ability and public accessibility as core values for the renewal and 
improvement of the city’s public services. In addition, the city ini- 
tiated a Corporate Access and Privacy (CAP) Renewal project to 
identify ways to better address access and privacy responsibilities. 
With respect to processing access requests, the request backlog 
was significantly reduced, and efforts to expedite record retrieval 
were implemented. In fact, if backlogged requests are removed 
from the equation, the city’s compliance rate for requests 
received in 2004 is 75 per cent. Recently, the acquisition of a new 
access request tracking system was approved. The CAP renewal 
project continues to address training needs, resources and 


accountability challenges. 
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The 2004 compliance rates for those municipalities in the popu- 
lation-under-50,000 category that received the most requests are 
generally impressive. The towns of Georgina and Parry Sound 
are to be commended for their 100 per cent compliance with the 


30-day standard. 


All of the municipalities that received the most requests in the 
third population category (50,000 to 200,000) had excellent 2004 
compliance rates. The City of Thunder Bay maintained its 100 
per cent compliance rate and is joined this year by the City of 
Vaughan. The City of Kitchener and Town of Oakville also 
achieved 100 per cent compliance, when the issuance of Notices 


is considered. 


We highly commend all of the municipalities noted above who 


were able to achieve outstanding results. 


POLICE SERVICES 


In 2004, police services achieved an overall 30-day compliance 
rate of 71.6 per cent, down from 77.3 per cent in 2003. However, 
when Toronto Police Services is excluded, the overall compliance 


rate for police services is 87.1 per cent. 


Once again, we commend the Halton Regional Police Services 
for maintaining its 100 per cent compliance rate. When section 20 
and 21 Notices are taken into account, the compliance rate of the 
Niagara Regional Police Service is an impressive 98.5 per cent. 
Special recognition should also be given to the Hamilton Police 
Service for achieving a 92.5 per cent compliance rate this year, an 


impressive climb from 75.6 per cent, including Notices, in 2003. 


However, we note a significant decline in the Durham Regional 
Police Service’s compliance rate, which was 51.5 per cent in 2004, 
down from 80.5 per cent in 2003, when the issuance of Notices 1s 
considered. Durham Regional Police Service, which had a 20 per 
cent increase in requests in 2004, advises that it is taking the 
decline in its compliance rate seriously and is reviewing staffing 


levels to meet increasing demands. 


The Toronto Police Service compliance rate continues to be sub- 
standard. In 2004, only 32 per cent of requests filed with that 
police service were responded to within 30 days, down from 32.5 
per cent in 2003. When section 20 and 21 Notices are factored in, 
the compliance rate for 2004 reached 34.8 per cent, down from 
35.6 percent in 2003. The loss of experienced staff, including the 


co-ordinator, was cited as a contributing factor. 


The Commissioner met with the then-head of the Toronto 
Police Services Board last year. The Toronto Police Service 
advises that initiatives have been undertaken to improve com- 
pliance, including an internal audit to review practices and 
operational policies, improvements to the tracking system as 
well as measures to enhance prompt record retrieval and 


reduce the request backlog. 


HEALTH BOARDS 


This is the second year that we are reporting on the compliance 
rates of local health boards. Compared to municipal corpora- 
tions and police services boards, these institutions receive a 
modest number of access requests — but more than boards of 
education, which was the other municipal category we previ- 


ously reported on. 


In responding to these requests, the collective effort of health 
boards continues to yield impressive results. We commend all 
the health boards listed in our statistical report, especially the 
Brant County Health Unit, the North Bay & District Health 
Unit and the Windsor-Essex County Health Unit for their 100 


per cent compliance. 
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Top Five Municipal Corporations (population under 50,000) based on numbers of requests completed 


Town of Caledon (49,740) 

City of Cornwall (42,623) 

Town of Georgina (36,597) 
Corporation of Haldimand (41,072) 
Town of Parry Sound (5,357) 


Requests 


Received 


Requests 
Completed 


Within 1-30 days 
No. of Requests % 


Within 31-60 days 
No. of Requests % 


Within 61-90 days 
No. of Requests % 


Top Five Municipal Corporations (population between 50,000 and 200,000) based on numbers of requests completed 


City of Kitchener (178,178) 

Town of Oakville (144,128) 

Town of Richmond Hill (124,740) 
City of Thunder Bay (102,617) 
City of Vaughan (186,015) 


Requests 
Received 


Requests 
Completed 


Within 1-30 days 
No. of Requests % 


Within 31-60 days 
No. of Requests % 


Top Five Municipal Corporations (population over 200,000) based on numbers of requests completed 


City of Hamilton (469,987) 
City of Mississauga (570,988) 
City of Ottawa (741,105) 

City of Toronto (2,125,394) 
Municipality of York (707,790) 
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Requests 
Received 


Requests 
Completed 


Within 1-30 days 
No. of Requests % 


Within 31-60 days 
No. of Requests % 


Within 61-90 days 
No. of Requests % 


Within 61-90 days 
No. of Requests % 


More than 90 days 
No. of Requests % 


More than 90 days 
No. of Requests % 


More than 90 days 
No. of Requests % 
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Top Five Municipal Corporations Compliance including Notice of Extension and Notice to Third Parties (population under 50,000) 


based on number of requests completed 


: 30-day compliance % Compliance including s. 20(1) / 21(1) % 


Town of Caledon 
Town of Cornwall 

Town of Georgina 

Corporation of Haldimand 

Town of Parry Sound 


Top Five Municipal Corporations Compliance including Notice of Extension and Notice to Third Parties (population between 50,000 and 200,000) 


based on number of requests completed 


30-day compliance % Compliance including s. 20(1) / 21(1) % 


| City of Kitchener 

Town of Oakville 
| Town of Richmond Hill 
City of Thunder Bay 


City of Vaughan 


Top Five Municipal Corporations Compliance including Notice of Extension and Notice to Third Parties (population over 200,000) 


based on number of requests completed 


30-day compliance % Compliance including s. 20(1) / 21(1) % 


City of Hamilton 
: City of Mississauga 
City of Ottawa 


City of Toronto 


Municipality of York 
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Top Five Health Boards ranked on number of requests completed 


Requests Requests Within 1-30 days Within 31-60 days Within 61-90 days More than 90 days | 
Received Completed No. of Requests % No. of Requests % No. of Requests % No. of Requests % ‘ 


Algoma Health Unit 
Brant County Health Unit 


Hastings & Prince Edward 
Counties Health Unit 


North Bay & District Health Unit 


Windsor-Essex County Health Unit 


Top Five Police Institutions ranked on number of requests completed 


Requests Requests Within 1-30 days Within 31-60 days Within 61-90 days More than 90 days 
Received Completed No. of Requests % No. of Requests % No. of Requests % No. of Requests % 


Durham Regional Police Service 
Halton Regional Police Service 
Hamilton Police Service 
Niagara Regional Police Service 


Toronto Police Service 
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Top Five Health Boards ranked on number of requests completed 


Compliance including Notice of Extension and Notice to Third Parties 


30-day compliance % 


North Bay & District Health Unit . 


_ Windsor-Essex County Health Unit 


Top Five Police Institutions ranked on number of requests completed 


Compliance including Notice of Extension and Notice to Third Parties 


30-day compliance % 


Durham Regional Police Service 

Halton Regional Police Service 

Hamilton Police Service 
Niagara Regional Police Service 


Toronto Police Service 


Compliance including s. 20(1) / 21(1) % 


Compliance including s. 20(1) / 21(1) % 
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UCR Ci oes 


The concept that most government-held information is accessible to anyone who wants to see it is one of the funda- 


mental principles of accountable government and participatory democracy. This principle is reflected in the provincial 


and municipal Acts, which provide that, subject to limited and specific exemptions, information under the control of 


government organizations should be available to the public. 


If you make a request under one of the Acts to a provincial or 
municipal government organization and are not satisfied with 
the response, you can appeal the decision to the IPC. Records that 
do not contain the personal information of the requester are 
referred to as “general records.” General records appeals can be 
filed concerning a refusal to provide access to general records, the 
amount of fees charged, the fact that the organization did not 
respond within the prescribed 30-day period, or other procedural 
aspects relating to a request. (Appeals relating to requests for 
access to one’s own personal information are covered in this 


annual report in the chapter entitled Privacy.) 


When an appeal is received, the IPC first attempts to settle it 
informally. If all issues cannot be resolved within a reasonable 
period of time, the IPC may conduct an inquiry and issue a 
binding order, which could include ordering the government 


organization to release all or part of the requested information. 


Te) 


TATISTICAL OVERVIEW 


In 2004, 827 appeals regarding access to general records and per- 
sonal information were made to the IPC, a decrease of 13 per cent 
from 2003. The overall number of appeals closed in 2004 was 903, 


a decrease of seven per cent compared to 2003. 


Access to General Records 


APPEALS OPENED 


Overall, 502 appeals regarding access to general records were 
made to the IPC in 2004. Of these, 253 were filed under the 
provincial Act and 249 under the municipal Act. (Percentage fig- 
ures are rounded off in this report and may not add up exactly to 100.) 


Of the 253 provincial general records appeals received, 199 
involved ministries and 54 involved agencies. The Ministry of 


Community Safety and Correctional Services was involved in the 
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largest number of general records appeals (39), followed by the 
Ministry of Health and Long-Term Care (33), and the ministries 
of Natural Resources (22), the Attorney -General (f2) 
Transportation (eight) and Consumer and Business Services 
(eight). The agencies with the highest number of general records 
appeals included the Ontario Lottery and Gaming Corporation 
(eight), Hydro One (seven), the Archives of Ontario (seven), 
Ontario Realty Corporation (six) and the Office of Public 


Guardian and Trustee (six). 


Of the 249 municipal general records appeals received, 146 (59 
per cent) involved municipalities, 60 (24 per cent) involved the 
police, and 18 (seven per cent) involved boards of education. An 
additional 25 (10 per cent) appeals involved other types of munic- 


ipal institutions. 


In terms of the issues raised, 54 per cent of general appeals 
were related to the exemptions claimed by institutions in 
refusing to grant access. An additional seven per cent con- 
cerned exemptions, plus other issues. Ten per cent of appeals 
were the result of “deemed refusals” to provide access, in 
which the institution did not respond to the request within the 
timeframe required by the Acts. In about eight per cent of 
appeals, the issue was whether the institution had conducted a 
reasonable search for the records requested, while another five 
per cent were third party appeals. The remaining appeals 


related to fees, time extensions and other issues. 


Provincial institutions with the largest number of deemed refusal 
appeals included the ministries of Environment (eight) and 
Health and Long-Term Care (six). Municipal institutions with 
the largest number of deemed refusal appeals included the City 
of Toronto (12), the Town of Oakville (three) and the Toronto 


Police Services Board (three). 


Deities 


Most appellants were individual members of the public (52 per 
cent). A substantial portion of appellants came from the business 
community (27 per cent). (A company appealing a denial of 
access to a competitor’s bid for a government contract would be 
categorized as a business appellant.) Other appellants included 
the media (nine per cent), associations (seven per cent) and gov- 
ernment (three per cent). (If a municipality appealed a decision of 
a provincial government institution, the municipality would be 


categorized as a “government” appellant.) 


Lawyers (71) and agents (18) represented appellants in 18 per cent 


of general records appeals made in 2004. 


In 2004, $9,170 in application fees for general record appeals was 
paid to the IPC. 


APPEALS CLOSED 
The IPC closed 562 general records appeals during 2004. Of 


these, 278 (49.5 per cent) concerned provincial institutions and 


284 (50.5 per cent) concerned municipal institutions. 


Sixty-seven per cent of general records appeals were closed 
without the issuance of a formal order. Of these, five per cent 
were screened out, 56 per cent were mediated in full, 33 per 
cent were withdrawn, four per cent abandoned, and one per 
cent dismissed without an inquiry. Of the 211 general records 
appeals that were not mediated in full and went on to adjudi- 
cation, 114 appeals (54 per cent) were mediated in part during 


the mediation stage. 


The proportion of appeals that were screened out, mediated in 
full or withdrawn was roughly equivalent over both the munic- 
ipal and provincial sectors. Of the 562 general records appeals 
closed in 2004, 22 per cent were closed during the intake stage, 40 
per cent during the mediation stage, and 38 per cent during the 


adjudication stage. 


* Of the appeals closed during the intake stage, 71 per cent 
were withdrawn, 16 per cent were screened out, seven 
per cent abandoned, six per cent closed by issuing a 


formal order, and one per cent mediated in full. 


* Of the appeals closed during the mediation stage, 92 per 
cent were mediated in full, four per cent were closed by 
issuing a formal order, four per cent were withdrawn, 


and one per cent abandoned. 


* Of the appeals closed during the adjudication stage, 82 
per cent were closed by issuing a formal order, 13 per cent 
were withdrawn, two per cent were abandoned, one per 
cent were mediated in full and one per cent were dis- 


missed without an inquiry. 


In 2004, 33 per cent of general records appeals were closed by 
issuing an order. The IPC issued a total of 185 final orders per- 
taining to general records — 84 provincial and 101 municipal 
orders’. In addition, the IPC issued 13 interim orders — four 


provincial and nine municipal’. 


In the general records appeals resolved by order, the decision of 
the head was upheld in 32 per cent and partly upheld in 34 per 
cent of cases. The head’s decision was not upheld in just under 25 
per cent of the appeals closed by order. Ten per cent of the orders 
issued in 2004 had other outcomes. In comparing the outcome of 
provincial and municipal orders, it is notable that the decision of 
the head is slightly more likely to be upheld or partly upheld in 


provincial orders. 


The number of appeals closed by order exceeds the number of orders, since one order may 


close more than one appeal. 


iS) 


Overall, the IPC issued a total of 279 final orders — 185 pertaining to access to general records 
and 94 pertaining to access to personal information. Also, the IPC issued 17 interim orders — 13 


pertaining to access to general records and four pertaining to access to personal information. 
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Issues in General Records Appeals 


Exemptions 


Exemptions with other issues 


Deemed refusal 
Reasonable search 
Interim decision 
Third party 

Fees 

Time extension 
Frivolous/vexatious request 
Transfer 

Failure to disclose 
Inadequate decision 
Other 


Total 


Types of Appellants 


Academic/Researcher 
Business 
Government 
Individual 

Media 
Association/Group 
Politician 

Union 


Total 


Provincial 


138 
18 


Provincial 


100 


Outcome of Appeals Closed Other Than by Order 


Screened out 
Mediated in full 
Withdrawn 
Abandoned 

No inquiry 


Total 
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53.0 
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11.3 
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0.4 
0.8 
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Total 
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1.3 
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Outcome of Appeals Closed by Order 


 Head’s Decision Provincial % Municipal % Total % 


Upheld 

Partly upheld 
Not upheld 

Other 

Total 


Outcome of Appeals by Stage Closed 


Screened out 0 (0.0%) 
Mediated in full 3 (1.4%) 
Withdrawn 28 (13.3%) 
Abandoned 4 (1.9%) 
Bx inquiry 3 (1.49%) 
Ordered 173 (82.0%) 
Total 211 (100.0%) 


Screened out 20 (15.9%) 
Mediated in full 1 (.08%) 
Withdrawn 89 (70.6%) 
Abandoned 9 (7.1%) 

No inquiry 0 (0.0%) 
Ordered 7 (5.6%) 

Total 126 (100%) 


Intake 


Screened out 0 (0.0%) 
Mediated in full 207 (92.0% 
Withdrawn 8 (3.6%) 
Abandoned 2 (0.8%) 

No inquiry 0 (0.0%) 
Ordered 8 (3.6%) 

Total 225 (100.0%) 
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PRIVACY 


To help protect personal privacy, the provincial and municipal Freedom of Information and Protection of Privacy Acts estab- 


lish rules that govern the collection, retention, use, disclosure, security, and disposal of personal information held by govern- 


ment organizations. 


If you believe that a provincial or municipal government organi- 
zation has failed to comply with one of the Acts and that your pri- 
vacy has been compromised as a result, you can file a complaint 
with the IPC. In the majority of cases, the IPC attempts to 
mediate a solution. The IPC may make formal recommendations 


to a government organization to amend its practices. 


STATISTICAL OVERVIEW 


Overall, 128 privacy complaints were opened in 2004, compared 
to 104 in 2003, an increase of 23 per cent. There were 126 com- 
plaints closed in 2004, compared to 128 in 2003, a decrease of 
about two per cent. (Percentages in this report have been 
rounded off and may not add up exactly to 100.) Seventy-six (59 
per cent) of the complaints opened in 2004 were filed under the 
provincial Act and 41 (32 per cent) were filed under the munic- 
ipal Act. Eleven (nine per cent) non-jurisdictional complaints 
were opened. Of the 128 complaints opened in 2004, 92 (72 per 
cent) were initiated by individuals and 36 (28 per cent) were ini- 


tiated by the Commissioner. 


The complaints that were resolved in 2004 involved 133 issues. 
The disclosure of personal information was the most frequent 
issue, raised in 62 per cent of complaints. The collection of per- 
sonal information was an issue in 22 per cent, security was an 
issue in five per cent, and the use of personal information was an 
issue in four per cent of complaints. The remainder involved 
other issues, including retention, disposal, access, notice of collec- 


tion, and general privacy issues. 


Eighty-two per cent of the issues raised in the privacy 
complaints were disposed of without the need for a finding. For 
the issues requiring a finding, institutions were found to have 
complied with the Aczs in 50 per cent of complaints, to have 
complied in part in 21 per cent of complaints and not to have 


complied in 29 per cent. 
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While processing privacy complaints, the IPC continues to 
emphasize informal resolution. Consistent with this approach, 
108 of the 126 privacy complaints closed in 2004 — 86 per cent 
— were closed without the issuance of a formal privacy com- 
plaint report. One hundred and one complaints (80 per cent) 
were closed during the intake stage. Of these, 22 per cent were 
screened out, two per cent were abandoned, 14 per cent were 
withdrawn, and 62 per cent were resolved informally. Twenty 
per cent of complaints proceeded to the investigation stage. Of 
the complaints closed during investigation, seven (28 per cent) 
were settled, and 18 (72 per cent) were closed by issuing a 
report. Eighteen privacy complaint reports were issued in 2004, 
containing a total of 36 recommendations to government 


organizations. 


Of the 126 complaints closed in 2004, individual members of the 
public initiated 69 per cent and the Commissioner initiated 31 


per cent. 


Personal Information Appeals 


The Acts also provide a right of access to, and correction of, your 
personal information. If you make a request under one of the 
Acts to a provincial or municipal government organization for 
your personal information, and you are not satisfied with the 
response, you can appeal the decision to the IPC. Personal infor- 
mation appeals can be filed concerning a refusal to provide access 
to your personal information, a refusal to correct your personal 
information, the amount of fees charged, the fact that the organ- 
ization did not respond within the prescribed 30-day period, or 
other procedural aspects relating to a request. (Appeals relating 
to requests for access to general records are covered in the chapter 


entitled Access.) 


When an appeal is received, the IPC first attempts to settle it 
informally. If all the issues cannot be resolved within a reasonable 


period of time, the [PC may conduct an inquiry and issue a 


Summary of Privacy Complaints - 2004 


2003 Privacy Complaints 


Provincial Municipal — Non jurisdictional 
aye 46 8 
Blosed 60 2 


binding order, which could include ordering the government 


organization to release all or part of the requested information. 


STATISTICAL OVERVIEW 


In 2004, 827 appeals regarding access to general records and per- 
sonal information were made to the IPC, a decrease of 13 per cent 
compared the number of appeals received in 2003. The overall 
number of appeals closed in 2004 was 903, a decrease of seven per 


cent from the previous year. 


Access and Correction of Personal Information 


APPEALS OPEN 


Overall, 325 appeals regarding access or correction of personal 
information were made to the IPC in 2004. Of these, 135 (42 per 
cent) were filed under the provincial Act and 189 (58 per cent) 
were filed under the municipal Act. One non-jurisdictional per- 


sonal information appeal was made in 2004. 


Of the 135 provincial personal information appeals received, 113 
(84 per cent) involved ministries and 22 (16 per cent) involved 
agencies. The Ministry of Community Safety and Correctional 
Services was involved in the largest number of personal informa- 
tion appeals (68), followed by the ministries of the Attorney 
General (10), Community and Social Services (10), Health and 
Long-Term Care (eight) and Consumer and Business Services 
(six). The agencies with the highest number of personal informa- 
tion appeals included the Ontario Human Rights Commission 
(five), the Workplace Safety and Insurance Board (five), the 
Ontario Rental Housing Tribunal (two), Sheridan College of 
Applied Arts and Technology (two), and the Workplace Safety 


and Insurance Appeals Tribunal (two). 


Of the 189 municipal personal information appeals received, 135 


(71 per cent) involved police services, 37 (20 per cent) involved 


2004 Privacy Complaints 


Total Provincial Municipal Non zurisdictional Total 
ie | ae 4] ig 128 
28 | 41 a 126 


municipalities, and six (three per cent) involved boards of educa- 
tion. Eleven appeals (six per cent) involved other types of munic- 


ipal institutions. 


Sixty-six per cent of personal information appeals were related to 
the exemptions claimed by institutions in refusing to grant access. 
An additional five per cent concerned exemptions plus other 
issues. Nine per cent of personal information appeals were the 
result of deemed refusals to provide access, in which the institu- 
tion did not respond to the request within the time frame 
required by the Aczs. In about 10 per cent of appeals, the issue was 
whether the institution had conducted a reasonable search for the 
records requested, and in about two per cent of appeals, the issue 
was whether the request had been frivolous or vexatious. The 
remaining appeals were related to fees, interim decisions, time 


extensions and various other issues. 


In comparing municipal and provincial appeals, municipal per- 
sonal information appeals were slightly more likely to involve 
deemed refusals or exemptions and provincial personal informa- 
tion appeals were more likely to involve the reasonableness of the 


search for records or other issues. 


Of the provincial institutions, the Workplace Safety and Insurance 
Board had the highest number of deemed refusals (four), and the 
Ministry of Community Safety and Correctional Services had the 
next highest number (two). Of the municipal institutions, the 
Toronto Police Services Board had the highest number of deemed 
refusal appeals (seven). No other provincial or municipal institu- 
tion had more than one deemed refusal in 2004. 

Since personal information appeals, by definition, relate to a 
request for access and/or correction of one’s own personal infor- 
mation, all appellants were categorized as individuals. Lawyers 
(75) or agents (14) represented appellants in 27 per cent of the 
personal information appeals made in 2004. 

In 2004, $2,186 in application fees for personal information 
appeals was paid to the IPC. 
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Number of Privacy Complaints Closed 1999-2004 


Provincial 


1999 
2000 
2001 
2002 
2003 
2004 


Privacy Complaints by Type of Resolution 


Provincial % 
Screened out ee 2 
Abandoned 
Withdrawn 

Settled 

Informal Resolution 
Report 

Total 


Source of Complainants 


Provincial % 


Individual 
IPC Commissioner Initiated 


Total 


Municipal 


Municipal 


% _ Non-urisdictional % 


Yo Non urisdictional % 


fs a 


Privacy Complaints by Type of Resolution and Stage Closed 


Screened out 
Abandoned 
Withdrawn 

Settled 

Informal resolution 
Report 

Total 


Issues* in Privacy Complaints 


Provincial % 
Disclosure 57. 225.0) 
Collection 8 10.6 
Use 2 2.6 
Security 5 6.6 
Retention 2 2.6 
Disposal 0 0 
Access 0 0 
Personal information 0 0 
Notice of collection 0 0) 
General privacy 2 2.6 
Right of correction 0 0 
Total 76 100 


Intake 
22 


Municipal 
25 
11 


46 


% 
5458 
23.9 


100 


Investigation % 


Non urisdictional % 


i 


— 
(esr py MP eee ad cays Resa lee) ema RR ey essa ee Kem) 


— 
—_ 


oat 
90.9 
0 


es aa Seats ft ae fs ned ges sd Geass Nae a Oe 


100 


Total 


EDO SAND Ses, BD | GSD 


133 


62.4 
21.8 


* The number of issues does not equal the number of complaints closed, as some complaints may involve more than one issue. 


Outcome of Issues* in Privacy Complaints 


Provincial % 
Did not comply with the Act 4 D3 
Complied with the Act 7 9.2 
Act does not apply 7 9.2 
Resolved — Finding not necessary DOr foe) 
Complied in part 2 2.6 
Total 76 100 


* The number of issues does not equal the number of complaints, as some complaints involve more than one issue. 


Municipal 
3 
2 


100 


Non zurisdictional % 


0 


0 


100 


Total 


% 
5:3 
9.0 

15.8 
66.1 
3.8 
100 
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Issues in Personal Information Appeals 


Provincial Municipal 


Exemptions 


ee 
Exemptions with other issues 
Deemed refusal 
Reasonable search 
Time extension 
Interim decision 
Frivolous/vexatious request ae 0 
Correction 
Third party Ce ee 
Total 2 ae 


| This table does not include one non-jurisdictional personal information appeal filed in 2004. The issue in this appeal was classified as “other.” 


Outcome of Appeals Closed by Order Outcome of Appeals Closed Other Than by Order 


Municipal Municipal 


Head’s Decision 


Mediated in full 65 
Withdrawn 37 


Upheld 33 
Partly upheld 10 
Not upheld 4 


Screened out 18 


Abandoned 9 


Other 4 : ; 

No inquiry 0 
Total 51 

Total 129 
Provincial Provincial 


Head’s Decision 


Mediated in full 69 


Upheld 31 Withdrawn 30 


Partly upheld 9 
Not upheld 5 
Other 2 


Screened out 9 


Abandoned 2 


No inquiry 3 
Total 47 Total 113 
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APPEALS CLOSED 
The IPC closed 341 personal information appeals during 2004. 


Of these, 160 (47 per cent) concerned provincial institutions, 
while 180 (53 per cent) concerned municipal institutions. The 


IPC closed one non-jurisdictional personal information appeal 


during 2004. 


Seventy-one per cent of personal information appeals were closed 
without the issuance of a formal order. Of the appeals closed by 
means other than an order, 11 per cent were screened out, 55 per 
cent were mediated in full, 28 per cent were withdrawn, four per 
cent were abandoned, and one per cent dismissed without an 
inquiry. Of the 107 personal information appeals that were not 
mediated in full and went on to adjudication, 66 appeals (62 per 


cent) were mediated in part during the mediation stage. 


Of the 341 personal information appeals closed in 2004, 28 per 
cent were closed during the intake stage, 41 per cent were closed 
during the mediation stage, and 31 per cent were closed during 


the adjudication stage. 


« Of the appeals closed during the intake stage, 59 per cent 
were withdrawn, 30 per cent were screened out, eight per 
cent were abandoned, and three per cent were closed by 


issuing a formal order; 


+ Of the appeals closed during the mediation stage, 95 per 
cent were mediated in full, two per cent were closed by 
issuing a formal order and three per cent were with- 


drawn; 


- Of the appeals closed during the adjudication stage, 86 
per cent were closed by issuing a formal order, six per 
cent were withdrawn, three per cent were abandoned, 
two per cent were mediated in full and three per cent 


were dismissed without an inquiry. 


In 2004, 29 per cent of personal information appeals were closed 
by issuing an order. The IPC issued a total of 94 final orders for 
personal information appeals — 45 provincial and 49 municipal '. 
In addition, the IPC issued four interim orders — two provincial 


and two municipal. 


In appeals resolved by order, the decision of the head was upheld 
in 65 per cent and partly upheld in 19 per cent of cases. The 
head’s decision was not upheld in nine per cent of the personal 
information record appeals closed by order. Six per cent of the 
orders issued in 2004 had other outcomes. In comparing the out- 
comes of provincial and municipal orders, the decision of the 
head was almost equally likely to be upheld or partly upheld for 
both municipal and provincial orders. The head’s decision was 


somewhat more likely not to be upheld in provincial orders. 


1 


The number of appeals closed by order exceeds the number of orders, since one order may 


close more than one appeal. 
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Outcome of Appeals by Stage Closed 


Screened out 0 (0.0%) 
Mediated in full 2 (1.9%) 
Withdrawn 7 (6.5%) 


Abandoned 3 (2.8%) 


No inquiry 3 (2.8%) 
Ordered 92 (86%) 
Total 107 (100.0%) 
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Adjudication : 


. . 4 
Mediation 


Screened out 0 (0.0%) 


Mediated in full 132 (95.0%) 


Withdrawn 4 (2.9%) 
Abandoned 0 (0.0%) 
No inquiry 0 (0.0%) 


Ordered 3 (2.1%) 
Total 139 (100.0%) 


| 
| 


Screened out 28 (29. 
Mediated in full 0 (0 
Withdrawn 56 (58.9 
Abandoned 8 (8.4% 
No inquiry 0 (0.0%) 
Ordered 3 (3.2%) 
Total 95 (100.0%) 


MANAGEMENT BOARD SECRETARIAT AND THE 
MINISTRY OF FINANCE (PC-040077-1 
AND PC-040078-1) 


The Commissioner tabled a Special Report to the Legislative 
Assembly of Ontario on the Disclosure of Personal Information by 
the Shared Services Bureau of Management Board, and the 
Ministry of Finance on December 16. 


The Ontario government has a number of programs that involve 
the mailing of cheques to individuals. The cheques for some pro- 
grams are printed at the iSERV data centre in Downsview and 
mailed out by the Shared Services Bureau (the SSB) of 
Management Board Secretariat (MBS). 


The IPC was notified by both the Ministry of Finance (ministry) 
and MBS about a breach of the Freedom of Information and 
Protection of Privacy Act (the Act) that occurred with the 
November 30, 2004 mailout of cheques for the Ontario Child 
Care Supplement for Working Families (OCCS) program under 


the ministry. 


The majority of individuals who receive an OCCS payment 
receive it through a direct deposit of funds into their bank 
accounts. The other individuals receive payment by way of a 
cheque that is mailed out on a monthly basis. For recipients who 
receive their supplement by direct deposit, no cheque stub 1s 
issued. The ministry advised that each of the approximately 
27,000 cheques that were mailed out on November 30, 2004 con- 
tained the recipient’s name, address, amount paid and Social 
Insurance Number (SIN), along with four additional digits 
directly following the SIN. However, for the majority of the 
cheques, the counter-foil (the cheque stub) contained the name 
and SIN of the recipient as well as the name, address, and the 
SIN, along with four additional digits, of another recipient. 
Seven cheque stubs contained various computations of the same 
type of information. Asa result, the IPC initiated a privacy inves- 


tigation under the Act. 


HIGH PROFILE PRIVACY INCIDENTS 


The investigation included numerous meetings with the ministry 
and MBS, as well as a site visit to the iSERV facility in 
Downsview by IPC staff. The ministry and MBS fully co-oper- 
ated with the IPC throughout our investigation. 


The investigation determined that the incident was triggered as 
a consequence of a software system enhancement to the payment- 
processing application used by the ministry and MBS. It is the 
munistry’s view that the source of the problem was human error 
in the implementation of a computer software upgrade, which 
caused a spacing problem in the printing of each cheque stub, 
resulting in information about the next recipient being added to 


the stubs, in the majority of cases. 


The investigation concluded that the disclosure of another indi- 
vidual’s personal information to recipients of the cheques was not 
in compliance with the Acz. All persons affected by the disclosure, 
with the exception of two individuals who could not immediately 
be reached, were notified by the ministry and the source of the 


technical problem was addressed. 


The Commissioner commended the ministry, which had pro- 
vided the information for the cheques, and MBS, of which the 
SSB is a unit, for immediately notifying her office of the privacy 
breach and the quick steps that both undertook to notify the 
cheque recipients about the problem. However, “the absence of 
controls and the existence of control weaknesses” within SSB 
“contributed to and exacerbated the problem,” said the 
Commissioner. “In addition, the absence of a manual inspection 
having been conducted on the cheques produced, to ensure the 
accuracy of all the information appearing on the cheques and 


cheque stubs, was another obvious weakness in the process.” 


As part of her special report, the Commissioner cited 10 other 
privacy breaches involving the SSB, including online issues and 
employee pay stubs. While each involved a small number of 
people — and a number of program or other changes were made 
on the government's initiative and on the recommendations of 


the IPC — the series of breaches concerned the Commissioner. 
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Asa result, the Commissioner recommended that: 


- Accomprehensive and independent end-to-end audit of 
SSB functions, operations and privacy practices that 
involve the handling of personal information be con- 
ducted and that this audit report be made available to 
the public; 

- The government discontinue the use of the SIN and 
create a purpose-specific unique identifier for each indi- 


vidual to replace the use of the SIN; and 


- Pending the outcome of the independent audit, MBS 
ensure, before each monthly printing of cheques 1s 
started, a short trial run is conducted on the printer to be 


used, with the test cheques manually inspected. 


MBS acted immediately on the Commissioner’s recommenda- 


tions, in addition to taking the following steps: 


« Examining closely the feasibility of appointing a Chief 
Privacy Officer (CPO), who would recommend how 
government can strengthen its policies and practices to 
ensure the protection of personal information in all gov- 
ernment operations (the Commissioner had recom- 
mended the appointment of a CPO in the Blueprint for 


Action section of her 2003 annual report); 


- Completing an ongoing internal audit and implementing 


its recommendations; and 


- Advising the IPC of all progress in completing these 


actions. 


PETERBOROUGH 


In 2001, the IPC published Guidelines for Using Video 
Surveillance Cameras in Public Places (the Guidelines) to assist 
government organizations in deciding whether the collection 
of personal information by means of a video surveillance 
system 1s justifiable as a policy choice, and if so, how privacy- 
protective measures can be built into the system. 

A group of individuals complained to the IPC in 2004 that the 
City of Peterborough (the city) was violating the Guidelines as 
there were no signs advising the public about the presence of 
video surveillance cameras in Millennium Park. The com- 
plainants were also concerned that the city might be violating 


other parts of the Guidelines at this site as well as at others. 
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The IPC initiated a review of the video surveillance programs 
in Millennium Park (the park), the Peterborough Centennial 
Museum and Archives (the museum) and the Peterborough 
Marina (the marina) to assess whether the surveillance pro- 


grams were in compliance with the Guidelines. 


The IPC learned that there are six video surveillance cameras in 
Millennium Park, one camera on the outside of the marina and 
two located at the museum. They were primarily introduced to 
prevent vandalism. At the time of the IPC’s site visit, there were no 
signs in the park notifying the public about the presence of video 
surveillance. The IPC was advised that signs were installed, but 


had been stolen. There were signs at the other locations. 


The IPC found several instances in which the city was not in com- 
pliance with the Guidelines and made nine recommendations. The 
IPC also noted that although the video surveillance systems 
offered some privacy-enhancing features, such as the absence of 
active camera monitoring, adherence to privacy protective prac- 
tices is critical in ensuring that the personal information collected 


by video surveillance is compliant with the Guidelines. 


Highlights of the IPC’s recommendations involved the city 
taking steps to do the following: 
- Installing signs in the park and bringing existing signs at 
the other sites into compliance; 


- Taking additional steps to ensure the security of stored 


videotapes; 


¢ Updating information sheets and making information 


about the video surveillance systems publicly available; 


- Addressing the park’s 10-week retention schedule for 
unused personal information with a view to reducing the 


retention time of this information; 


- Incorporating regular audits and evaluations into video 
surveillance practices; 
- Revising and updating its written video surveillance 
policy. 
The city was given a series of 2005 deadlines to comply with these 


recommendations. 


meee REVIEWS 


The courts rendered several decisions in 2004 clarifying the scope of the exemptions under the Freedom of Inform 


and Protection of Privacy Act and the Municipal Freedom of Information and Protection of Privac y Act 


In addition, the courts affirmed that the IPC's decisions are enti- 
tled to judicial deference and that the IPC is entitled to partici- 
pate in judicial reviews of its decisions. However, some 
uncertainties remain because a number of these decisions are sub- 
ject to appeal. (All sections cited are from the provincial Act, 


unless otherwise specified.) 


(1) In two cases heard together in 2004, the Divisional Court 
upheld three IPC decisions ordering disclosure of evaluation 
reports relating to the expenditure of public funds: one involving 
bids on highway construction projects and the other involving 
northern development grants. In both cases, the Court affirmed 
that it will defer to the IPC’s greater expertise in interpreting and 
applying the exemptions. 

In the first case, the Court held that the IPC was reasonable in 
finding that evaluation scores assigned by the Ministry of 
Transportation to measure contractors’ technical qualifications 
were essentially factual in nature and in rejecting the ministry's 
claims that the scores were exempt as “advice” to government 
under section 13. The IPC was also reasonable in holding that the 
“third party” exemption at section 17 did not apply because the 
scores were generated by the ministry and were not “supplied” by 
contractors. Finally, the Court agreed with the IPC that the min- 
istry’s evidence fell short of establishing that disclosure would 
permit contractors to manipulate the bidding process and thus 
cause harm to the ministry’s economic interests as contemplated 


by the section 18 exemption. 


The second case involved a request for disclosure of evaluation 
reports prepared by staff at the Ministry of Northern 
Development and Mines and used by a funding board in 
deciding whether to fund projects promoting tourism and devel- 
opment in Northern Ontario. Again, the Court held that the IPC 
was reasonable in finding that the “options” and “pros and cons” 
portions of the reports were not “advice” within the meaning of 
section 13 because this material was factual and did not reveal a 


suggested course of action put forward by ministry staff. 


WALLOON 


Cle 


J 


The Divisional Court’s decisions in both these cases have been 
appealed by the ministries concerned to the Ontario Court of 


Appeal. 


(2) In another case involving public expenditures, the Divisional 
Court upheld two IPC decisions ruling that the Ministry of the 
Attorney General could not claim either solicitor-client privilege 
under section 19 or personal privacy under section 21 to withhold 
the amount of legal fees it paid to lawyers representing two indi- 
viduals in high profile court cases. One decision involved the 
amount the ministry paid to lawyers appointed by the court to 
represent a client in his appeal of first degree murder convictions. 
The second decision involved the amount the ministry paid under 
court orders to lawyers retained to protect this client's interests in 
the trial of his former lawyer on obstruction of justice charges. 
The Divisional Court agreed with the IPC that aggregate sum- 
maries of the amounts were not privileged because they were not 
“communications,” but rather were “neutral” facts that did not 
reveal client confidences. In addition, the IPC was reasonable in 
holding that: (a) disclosure of the amounts paid in the appeal was 
not an unjustified invasion of the client's privacy due to the high 
profile nature of the case; and (b) the total amount paid in the 
other case was not personal information because it could not be 
broken out as between this individual and another client. Finally, 
the Court rejected the ministry’s argument that it should deny the 
IPC standing to make submissions supporting its decisions on 


judicial review. The ministry has appealed this decision. 


(3) In another case involving solicitor-client privilege, the 
Divisional Court found that the IPC erred in failing to apply the 
section 19 exemption to training and instruction manuals for the 
conduct of default proceedings under the Family Responsibility 
and Support Arrears Enforcement Act. The manuals were pre- 
pared by the Family Responsibility Office, which falls under the 
auspices of the Ministry of Community and Social Services, for 
use by outside lawyers retained to handle family support cases. 
The IPC relied on section 33(1) which requires institutions to 
make guidelines and instructions for the enforcement of a public 


statute available to members of the public. Since the manuals 
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were general in nature and did not relate to any specific legal 
proceeding, the IPC held they were not the proper subject of the 
privilege. The Court rejected the IPC’s view. It held that because 
all of the records were created and used to advise and instruct 
lawyers conducting legal proceedings, they were protected from 


disclosure by solicitor-client privilege. 


(4) In an area traditionally considered to be within the IPC’s spe- 
cialized expertise, the Divisional Court corrected an apparent 
misapplication of one of its earlier rulings in a case involving 
access to public registries of personal information. In the earlier 
case, the Court held that the privacy exemption at section 14 of 
the Municipal Freedom of Information and Protection of Privacy 
Act did not apply to an electronic database containing the per- 
sonal information of individual contributors to candidates in a 
municipal election, even though substantial privacy interests are 
implicated in the bulk disclosure of personal information in elec- 
tronic form. In the later case, the Court found that the IPC erred 
in applying the Court’s reasoning from that earlier ruling to 
order disclosure of a province-wide electronic database of per- 
sonal information contained in municipal assessment rolls. The 
Court distinguished the cases on two grounds. First, the munic- 
ipal assessment corporation that created the province-wide data- 
base was not governed by the statutory public inspection scheme 
that applied to paper copies of the rolls maintained by each 
municipality. Second, individual privacy interests should prop- 
erly yield for public accountability purposes where a news 
reporter seeks to scrutinize the election process; however, they 
should not yield for the private commercial purposes of a collec- 


tion agency seeking the assessment database. 


(5) Ontario’s Court of Appeal issued an important ruling in 2004 
overturning the Divisional Court and restoring an IPC decision 
limiting government’s discretion to refuse to confirm or deny the 
existence of a record under the privacy exemption at section 21. 
The question arose in the context of two news media requests for 
documents relating to the possible settlement of a benefits claim 
brought by an individual against the Ministry of Health and 
Long-Term Care. The IPC ruled that the ministry could invoke 
its discretion under section 21(5) only if disclosure of the mere 
existence or non-existence of an alleged settlement agreement 
would unjustly invade the individual’s privacy, which the IPC 
found it would not. The Divisional Court held that the IPC’s 


interpretation unreasonably circumvented the legislature’s inten- 
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Outstanding Judicial Reviews as of December 31, 2004: 25 | 


Launched by: 

Institutions: 11 
Requesters & Complainants: 7 
Institutions & Affected Parties: 1 


Affected Parties: 6 


New applications received in 2004: I1 


Judicial Reviews Closed/Heard in 2004: 14 


Abandoned, (Order Stands)!: 6 
Abandoned, (Order Stayed)*: 3 
IPC Order Upheld’: 2 


IPC Order Not Upheld’: 3 
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Abandoned (Order Stands):, PO-2023, MA-020309-1, PO-2119, PO-2205, MA-020157-2, MO-1785 
Abandoned (Order Stayed): PO-2128,PO-2099/PO-2126-R, PO-1995 

IPC Order Upheld: MO-1614, MO-1574-F/MO-1595-R 

IPC Order Not Upheld: PO-1994, MO-1693, PO-2034 


tion to create “airtight” privacy protection. The Court of Appeal, 
on the other hand, found that the IPC’s interpretation reasonably 
constrained the ministry’s discretion in a way that appropriately 
balanced access and privacy rights in cases where such confirma- 
tion would not unjustifiably invade an individual’s privacy. The 
ministry has sought leave to appeal this decision to the Supreme 


Court of Canada. 


(6) Finally, the constitutional validity of certain omissions from 
the Act was examined by the Divisional Court in light of their 
alleged infringement on the freedom of expression protected at 
section 2(b) of the Canadian Charter of Rights and Freedoms. The 
Criminal Lawyers’ Association (CLA) sought records relating to 
an investigation by the Ontario Provincial Police into alleged 
misconduct by police and Crown prosecutors investigating and 
prosecuting murder charges against two individuals. The IPC 
upheld the decision of the Ministry of Public Safety and Security 
refusing to disclose these records under exemptions for law 
enforcement, solicitor-client privilege and personal information 
at sections 14, 19 and 21. The IPC went on to hold that there was 
a compelling public interest in disclosure of the records under 
section 23 of the Act, which would override the privacy exemp- 
tion at section 21, but not the other exemptions at sections 14 and 
19 because these latter sections were not specified in the override 
provision. The CLA was ultimately unsuccessful in persuading 
the IPC and the Divisional Court that its freedom of expression 
was infringed by the legislature’s decision not to include sections 
14 and 19 within the public interest override. Even if section 23 
did infringe the CLA’s freedom of expression, the Court held 
that this breach would not be unconstitutional because the 
statute’s objectives were pressing and substantial and any impair- 
ment of the right was minimal and proportional to those obyec- 
tives. The CLA has been granted leave to appeal this decision to 
the Ontario Court of Appeal. 
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WORKING 


As part of its Institutional Relations Program, the IPC’s Tribunal 
Services Department works collaboratively each year with 
selected municipal and provincial organizations as part of its 
ongoing efforts to: 

- gain a better understanding of the business of our institu- 
tional clients in order to deal more effectively with 
appeals and complaints; and 

¢ provide IPC mediators and institutional staff with an 
opportunity to better understand each other’s roles and 


needs, and develop more productive relationships. 


Among the special meetings or joint projects in 2004 were the 


following: 


Mediation is the preferred method of dispute resolution at the 
IPC for both appeals and privacy complaints. The IPC is com- 
mitted to promoting the benefits of mediation to our clients by 
way of meeting with co-ordinators and their staff. In October 
2004, we invited various municipal and provincial co-ordinators 
and their staff to meet jointly with our entire mediation team to 
discuss the benefits of mediation in general, the different 
approaches taken in mediating appeals and privacy complaints, 


and to share our mediation successes. 


The IPC accepted an invitation from the Freedom of 
Information Police Network to have senior staff speak at its 
spring meeting and training workshop. This workshop is 
attended by co-ordinators and their staff from local police serv- 
ices across the province and from the Ontario Provincial Police. 
The IPC took this opportunity to give a presentation on an IPC 
paper entitled Fees, Fee Estimates and Fee Waivers for requests 
under the Freedom of Information and Protection of Privacy Act 
and the Municipal Freedom of Information and Protection of 


Privacy Act. 
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JOINT PAPER ON MEDIATING APPEALS 


The IPC and the Ministry of the Attorney General completed 
their work in 2004 on a joint publication, Best Practices for 
Institutions 1n Mediating Appeals under the Freedom of 
Information and Protection of Privacy Act and the Municipal 
Freedom of Information and Protection of Privacy Act. (This 
paper and the one below are available on the IPC website, 


Www.ipc.on.ca.) 


ELECTRONICALLY PROCESSING FOI REQUESTS 
Also in 2004, the IPC completed work with the Ministry of 


Natural Resources on an educational tool, The Advantages of 
Electronically Processing Freedom of Information Requests: The 
MNR Experience. 


OUTREACH PROGRAM 


INFORMATION ABOUT THE IPC 


The IPC has a vibrant outreach program to help meet its mandate to educate the public about Ontario’s access and pri- 


vacy laws and increase the public’s awareness of access and privacy issues. 


The five core components of the outreach program include: 
« the public speaking program; 
« the schools program; 
« the publications program 


- the media relations program; and 


° the IPC’s website. 


For the latter part of 2004, the IPC focused on the Personal 
Health Information Protection Act (PHIPA) — Ontario’s first new 
privacy Act in nearly 14 years — which came into effect Nov. 1, 
2004. Commissioner Ann Cavoukian and Ken Anderson, 
Assistant Commissioner for Privacy, met with the leaders of 
Ontario’s 22 regulatory colleges for health professionals — from 
the College of Physicians and Surgeons to the College of 
Pharmacists to the College of Chiropractors, to name a few — and 
with professional associations. The Commissioner and senior 
staff also made numerous presentations across Ontario to health 
professionals and other groups impacted by PHIPA. As well, the 
IPC participated fully in a series of information sessions on 
PHIPA that the Ministry of Health and Long-Term Care sched- 


uled in major cities across Ontario last fall. 


Speeches and Presentations 


Commissioner Cavoukian made 45 presentations in 2004, prima- 
rily as the keynote speaker at major conferences and as a guest at 
universities for special presentations. The Commissioner 
addressed, among others, the International Association of Privacy 
Professionals, the Ontario Hospital Association, the annual 
Privacy and Data Security Summit in Washington, D.C., the 
Corporate State Canada, the Information Technology Association 
of Canada, the Ontario Bar Association and more than a dozen 


other conferences or seminars for health professionals. 


Many of the presentations outside the health information privacy 
sphere focused on issues such as technology and security and 


their impact on privacy. 


Among the other segments of the IPC’s speakers’ program are: 


- the Reaching Out to Ontario program, where a team of 
speakers visits different regions of Ontario each year for 
a series of presentations. For the first time, the IPC 
focused on Toronto in 2004, aside from a series of presen- 
tations in Kenora. In 2005, the IPC returns to visiting 
communities across Ontario, with presentations in 


Halton Region, Durham Region and the Timmins area; 


* auniversity program, where members of the IPC’s Legal 
and Policy Departments make presentations to faculty 


and students in business, technology and law programs; 


* a general public speaking program, where IPC staff 
make presentations on access and privacy to various 


groups or organizations. 


Schools Program 

The IPC has a very successful schools program, entitled Whaz 
Students Need to Know About Freedom of Information and 
Protection of Privacy. It includes teacher resources tailored to the 
Grade 5 curriculum of government studies and the Grade 10 
civics course, as well as resources for Grade 11-12 history and law 
teachers. In addition, IPC staff make presentations to approxi- 


mately 40 Grade 5 classes every school year. 


The three teachers’ guides developed by the IPC with the aid of 
curriculum experts and classroom teachers, and brochures that 
describe the guides, are available on the IPC’s website at: 
www.ipc.on.ca 

Since the program was launched late in 1999, with the release of 
the guide for Grade 5 teachers, thousands of copies of the guides 


have either been sent to teachers or downloaded from the website. 
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IPC Publications 


In 2004, the IPC released 18 publications on access or privacy 
topics, including, in the latter part of the year, seven publications 
aimed at focusing attention on Ontario’s new health information 
privacy law, PHIPA. These included Frequently Asked Questions: 
Personal Health Information Protection Act, which provides a 
general overview of the Act, and A Guide to the Personal Health 
Information Protection Act, which was produced to help health 
care providers understand how PHIPA applies to their day-to- 
day activities. 

Among other 2004 publications are Incorporating Privacy into 
Marketing and Customer Relationship Management, a joint report 
by the IPC and the Canadian Marketing Association, and Tag, 
You're It: Privacy Implications of Radio Frequency Identification 
(RFID) Technology, an educational tool about this quickly 
expanding technology and the privacy issues associated with the 
technology. Among the papers specifically addressing access 
issues 1s Best Practices for Institutions In Mediating Appeals, a 
joint publication of the IPC and the Ministry of the Attorney 


General. 


A complete list of the IPC’s 2004 publications is in the section that 


follows this Outreach report. 


Media Relations 

Through its pro-active media relations program, the IPC tries to 
raise the media’s consciousness about access and privacy issues. The 
program includes meetings with the editorial boards of newspa- 
pers, presentations to newsrooms and media students, and the dis- 


tribution of news releases, IPC papers and other material. 


IPC staff also answer media inquiries relating to freedom of 
information, privacy and the new health information protection 
legislation. 

As the IPC’s official spokesperson, the Commissioner gave 60 
media interviews in 2004. Overall, the IPC assisted more than 180 
journalists who requested interviews, background information 
or who had general inquiries about access and privacy, including 
the process for filing freedom of information requests. The 


Commissioner issued 11 news releases in 2004. 
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IPC Website 


The IPC website (www.ipc.on.ca) offers a wide range of infor- 
mation about access and privacy issues and the legislation that 
applies. It provides answers to common questions, access to [PC ! 
publications and orders, links to copies of the Aczs (including the 
new PHIPA), educational material, news releases, selected 


speeches, other presentations by IPC staff, forms and more. 


More details about the IPC website are cited in a separate report 


on the website (which follows the Publications report). 


Peer wR ELC AT IONS 


Incorporating Privacy into Marketing and Customer 
Relationship Management. This is a joint report by the 
IPC and the Canadian Marketing Association. 


Cross-National Study of Canadian and U. S. Corporate 
Privacy Practices. This joint report summarizes the find- 
ings of a benchmark study — the first of its kind — con- 
ducted by the IPC and Ponemon Institute, an 
Arizona-based “think-tank.” 


Tag, You're It: Privacy Implications of Radio Frequency 
Identification (RFID) Technology. This is an educational 
tool to help the public understand what an RFID is, to 
help focus attention on the privacy issues, and to advance 
the privacy principles that need to be considered by busi- 


nesses during the design and use of this technology. 


Best Practices for Institutions in Mediating Appeals under 
the Freedom of Information and Protection of Privacy Act 
and the Municipal Freedom of Information and Protection 
of Privacy Act. This paper, a joint project of the IPC and 
the Ministry of the Attorney General, is aimed at govern- 


ment institutions. 


The Advantages of Electronically Processing Freedom of 
Information Requests: The MNR Experience. This educa- 
tional tool was co-produced by the IPC and the Ministry 


of Natural Resources. 


Promoting Transparency through the Electronic 
Dissemination of Information. This paper was prepared 
for the Symposium on E-Governance for the 21st 
Century, sponsored by the Saskatchewan Institute of 
Public Policy. It has been included as a chapter in E- 
Government Reconsidered: Transformation of Governance 
for the Knowledge Age, a book published in April 2004 by 


the institute. 


The spring 2004 edition of the IPC’s bi-annual 


newsletter, [PC Perspectives. 


Privacy and Access: A Blueprint for Action, Commissioner 


Ann Cavoukian’s annual report. 


Guidelines for Using RFID Tags in Ontario Public Libraries. 
These guidelines ensure privacy protections are considered 


during the development of implementation plans. 


The IPC has an extensive publishing program aimed at fostering increased awareness and under- 


standing of various access and privacy-related issues and topics. The papers released in 2004 included: 


- The fall 2004 edition of IPC Perspectives. 
* Frequently Asked Questions: Personal Health Information 


Protection Act. Aimed at the general public, this resource 
provides specific answers and a general overview of the 
Act, which came into effect Nov. 1, 2004. 


* A Guide to the Health Information Protection Act. This 
guide was produced to help health care practitioners and 
other health information custodians understand their 


rights and obligations under the new Act. 


« Frequently Asked Questions: Health Cards and Health 
Numbers. This resource provides general information 


about the use of Ontario health cards and health numbers. 


¢ The Personal Health Information Protection Act and Your 
Privacy. This plain-language IPC brochure answers basic 


questions about the Act. 


* Your Health Information: Your Rights - Your Guide to the 
Personal Health Information Protection Act, 2004. The 
IPC and the Ministry of Health jointly produced this 
eight-panel brochure. 


* Access and Correction Complaints — Personal Health 
Information Protection Act. This brochure outlines your 
rights if denied access to your personal health informa- 


tion, or correction of that information. 


* Collection, Use, Disclosure and Other Complaints — 
Personal Health Information Protection Act. This 
brochure explains that, if you feel that a health informa- 
tion custodian has inappropriately collected, used or dis- 
closed your personal health information, or does not have 
proper information practices in place, you have a right to 


make a complaint to the IPC. 


« I’m Sorry, this Meeting 1s Closed to the Public: Why We 
Need Comprehensive Open Meetings Legislation in 
Canada. Assistant Commissioner Tom Mitchinson pre- 
sented this paper at the annual conference of the Council 
on Governmental Ethics Laws (COGEL) in San 
Francisco in December. 

IPC publications are available on the IPC’s website, 
www.ipc.on.ca, or by calling the Communications Department 
at 416-326-3333 or 1-800-387-0073 to request copies of specific 
publications. 
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VAESBeort 


Among the major additions to the website (www.ipc.on.ca) in 
2004 was a new section devoted to Ontario’s first new privacy Act 
in 14 years, the Personal Health Information Protection Act, 


which came into effect in November 2004. 


Overall, there was a significant increase in the number of IPC 
publications downloaded in 2004. The 234,352 files downloaded 
represent an increase of 112,545 — or 92.4 per cent — over the 


121,807 files downloaded in 2003. 


For the third year running, the Privacy Diagnostic Tool (PDT) 
Workbook was the most popular paper. It was downloaded 22,715 
times, almost one-tenth of all downloads and nearly twice as many 
as the next most popular paper, Guidelines for Using RFID Tags in 
Ontario Public Libraries, which was downloaded 12,079 times. The 
third most popular resource was the IPC’s 2003 Annual Report, 


downloaded 9,179 times after being released in June. 


Although not released until the fall, the IPC’s two main publica- 
tions related to the new privacy legislation — A Guide to the 
Personal Health Information Protection Act and Frequently Asked 
Questions: Personal Health Information Protection Act — were 
very popular. Together, these two health privacy resources were 
downloaded 17,122 times, the fourth and fifth most popular files. 
Over the final quarter of the year, they were the downloaded 


more than any other papers. 
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The IPC uses its website as one of its primary communication tools to help meet its mandate to 


educate the public about Ontario’s access and privacy laws and policy issues. 


Other popular resources in 2004 included Tag, You’re It: Privacy 
(RFID) 


Technology, downloaded 6,871 times, Consumer Biometric 


Implications of Radio Frequency Identification 
Applications: A Discussion Paper, downloaded 5,957 times, and 
Cross-National Study of Canadian and U.S. Corporate Privacy 


Practices, downloaded 4,801 times. 


The section of the website that attracted the most visitors was the 
section devoted to IPC orders and privacy investigation reports. 
Other popular sections included the educational resources section 


for teachers. 
The IPC is constantly updating and improving the resources 


available on its website. If you have any comments on the content 


of the site, please forward them to info@ipc.on.ca. 


MONITORING LEGISLATION AND PROGRAMS 


Part of the mandate of the IPC under the Acts is to offer comment on the privacy protection and 
access implications of proposed government legislative schemes or programs. The IPC takes this 


mandate very seriously. The following list provides an overview of the work done by the IPC in this 


area during 2004. 


PROVINCIAL CONSULTATIONS 


Management Board Secretariat: 
- Internet tracking technologies; 
+ Impact of the U.S. Patriot Act; 
Ministry of the Attorney General: 


« Remedies for Organized Crime and Other Unlawful 
Activities Act, 2001; 


Ministry of Community and Social Services: 
- Family Responsibility Office; 
» Adoption disclosure; 
Ministry of Community Safety and Correctional Services: 
« Mandatory Reporting of Gunshot Wounds; 
« OPP In-Car Video Pilot Project; 
Ministry of Consumer and Business Services: 
¢«  ServiceOntario; 
- Birth Registry; 
Ministry of Education: 
« Video surveillance in schools; 
Ministry of Energy: 
- Bill 100, Electricity Restructuring Act, 2004; 
Ministry of Finance: 
« International Fuel Tax Association; 
Ministry of Health and Long-Term Care: 


* Development and implementation of the 
Personal Health Information Protection Act, 2004, 


+ Emergency Department Access to Drug History Project; 


¢ Client Registration and Identity Management System 
(CRIM); 

* Creation of Ontario’s Health Protection and Promotion 
Agency; 

* Integrated Public Health Information System (iPhis); 


« Smart Systems for Health; 


Ministry of Labour: 

+ Bill 63 - Amendments to the Employment Standards Act; 
Ministry of Transportation: 

- Authorized Requester Program; 
Democratic Renewal Secretariat: 


¢  Citizen’s Forum Initiative. 


MUNICIPAL CONSULTATIONS 


Dufferin Peel Catholic District School Board: 
« Posting student information on the Internet; 
Grand Erie District School Board: 
« Video surveillance; 
Hamilton Police Service: 
- Video surveillance; 
Lambton Kent District School Board: 
- Video surveillance; 
London and Middlesex Housing Corporation: 
« Applicant screening process; 


Peterborough Victoria Northumberland & Clarington Catholic 
District School Board: 


« Information sharing with service providers; 
City of Toronto: 
« Video surveillance; 


Toronto Police Services: 
- Proposed policy re retention of fingerprints and 
other personal information of people who 
were not found guilty; 


Waterloo Catholic District School Board: 
« Video surveillance; 
City of Windsor: 
« Video Surveillance; 
York Region District School Board: 
» Sharing information between elementary and 


secondary schools. 
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OTHER CONSULTATIONS 


Private Members’ Bills: 

- Bill 123, Transparency in Public Matters Act, 2004; 
Association of Municipal Managers, 
Clerks and Treasurers of Ontario: 


° Municipal voters’ list. 


INDIRECT COLLECTIONS 


City of Toronto: 
° E-Postcards. 


COMPUTER MATCHING ASSESSMENTS 


« Ministry of Community and Social Services and the 
Canada Customs and Revenue Agency; 


« Ministry of Community and Social Services and 
Human Resources Development Canada. 


SUBMISSIONS AND SPECIAL REPORTS 
« Special Report to the Legislative Assembly of Ontario 
on the Disclosure of Personal Information by the 
Shared Services Bureau of Management Board Secretariat, 


and the Ministry of Finance; 


¢ Submission to the Standing Committee on General 
Government: Bill 31: Health Information Protection Act. 
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ORGANIZATIONAL CHART 
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PINANCAE S TAT EM el 


2004-2005 Estimates $ 2003-2004 Estimates $ 2003-2004 Actual $ 


Salaries and wages 6,543,300 5,703,300 5,555,198 
Employee benefits 1,648,000 1,356,300 982,069 
Transportation and communications 300,000 180,400 184,835 
Services 1,733,400 840,200 1,186,535 
Supplies and equipment 533,900 275,400 440,254 
Total 10,758,600 8,355,600 8,348,891 


Note: The IPC’s fiscal year begins April 1 and ends March 31. 


The financial administration of the IPC is audited on an annual basis by the provincial Auditor. 


A ioe Daten al 


As required by the Public Sector Salary Disclosure Act, 1996, the following chart shows which IPC employees 
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received more than $100,000 in salary and benefits for the calendar year ending December 31, 2004. 


Name 

Cavoukian, Ann 
Anderson, Ken 
Beamish, Brian 
Mitchinson, Thomas 
Challis, William 
Goldstein, Judith 
Goodis, David 
Gurski, Mike 
Higgins, John 
Morrow, Bernard 
O'Donoghue, Mary 
Senoff, Shirley 


Swaigen, John 


Position 

Commissioner 

Assistant Commissioner, Privacy 
Assistant Commissioner, Access 
Assistant Commissioner 

General Counsel 

Legal Counsel 

Legal Counsel 

Senior Technology and Policy Adviser 
Senior Adjudicator & Manager of Adjudication 
Adjudicator 

Manager, Legal Services 

Legal Counsel 

Adjudicator 


Salary Paid 
$176,788.40 
$187,328.50 
$137,721.90 
$187,328.50 
$178,703.79 
$143,371.24 
$157,194.06 
$102,499.62 
$161,808.64 
$110,974.53 
$160,023.75 
$103,629.27 
$161,590.12 


Taxable Benefits 
$310.12 
$301.30 
$203.67 
$301.30 
$301.30 
$245.17 
$269.69 
$167.28 
$274.19 
$273.67 
$177.20 
$264.39 
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